See: gitlab-com/gl-infra/infrastructure#8270

`option forwardfor` is replaced by more ellaborate header setting, that takes the `cf-connecting-ip` header into account if the request comes from a cloudflare IP range.
It also maintains the required IP lists for cloudflare's IP ranges.

The functionality is gated behind a flag.