Cloudflare IPs are not trusted proxies.

### Describe the bug

After the fix of #25393, the client IP is now the rightmost untrusted IP, but when proxied behind Cloudflare, those IPs are not considered trusted. This shouldn't need to be added in the trusted cidrs flag because the Cloudflare IPs can change at any time, so a fix would be for Authentik to query https://www.cloudflare.com/ips/ every 12h or so to check what the current Cloudflare IPs are.

The issue stems from the fact that the X-Forwarded-For header now contains `REAL_IP, CLOUDFLARE_IP`, and after #25393, it is checked from the right rather than the left, but the Cloudflare IPs are not trusted.

### How to reproduce

Setup a reverse proxy (in my case, I used caddy).
Setup Cloudflare DNS with proxying on.
Login sessions come up as coming from the Cloudflare IP rather than the Real IP.

Note, this is with Cloudflare being set as a trusted proxy on Caddy, otherwise you just get the Cloudflare IP.

### Expected behavior

Expected: `REAL_IP`
Got: `CLOUDFLARE_IP`

### Screenshots

_No response_

### Additional context

A potential fix might be to have a setting like `AUTHENTIK_LISTEN__CLOUDFLARE_PROXY` as a boolean, but that's just my opinion. An alternative fix might be to take the IP from CF-Connecting-Ip if possible.

### Deployment Method

Docker

### Version

2026.8.1

### Relevant log output

```shell

```

Start by tracing the X-Forwarded-For handling changed by #25393 and how trusted CIDRs are applied. Reproduce the Caddy and Cloudflare setup described here, then verify that the resolved client address is REAL_IP rather than CLOUDFLARE_IP; the chosen approach should account for changing Cloudflare proxy ranges.

Written by the indexing model from the issue text.