Clean up XForwardedForMiddleware

XForwardedForMiddleware in edxapp contains several pieces of code relating to IP addresses.

The most recent part of the code (closest to the top, in that permalink) uses edx-django-utils to make various information about the client IP chain available to the application. This is currently working as desired, although it might not be the best place for it. However, the oldest part assumes there is only one true client IP, and then uses that to overwrite request.META['REMOTE_ADDR']. We'd like to delete this part, since it creates an incorrect and inconsistent view of the IP chain. This needs to be removed before the newer code can properly be extracted to a utility module somewhere—it overwrites information that the newer block needs to read. That order dependence is fragile.

In between, there's also some code that copies some values in request.META to new names, for a past Gunicorn upgrade. This will need to be carefully evaluated to determine whether it is still needed, and what to do with it. (Caution: The field and header variable names might be reversed here.) At the very least we'll want to expand the comments.

Acceptance criteria:

• DEPRs filed and accepted as needed
• Sweep for any remaining uses of REMOTE_ADDR or other code that thinks it has the "real client IP" and isn't already using the edx_django_utils.ip utils
• No longer overwrite request.META['REMOTE_ADDR']
• Move newer code (call to ip.init_client_ips, instrumentation) into a edx-django-utils middleware, and use that middleware instead
  • Also recommend to other teams that they use this
• Do something with the request.META field copying/renaming (delete? document better?)

Notes:

• Background reading: https://www.brainonfire.net/blog/2022/03/04/understanding-using-xff/

Start with openedx/core/lib/x_forwarded_for/middleware.py at the linked XForwardedForMiddleware implementation and inspect the edx_django_utils.ip usage plus request.META field copying. Then sweep the repository for REMOTE_ADDR and other real-client-IP handling, and review the DEPR requirements. Done means the overwrite is removed, the newer middleware behavior is moved to edx-django-utils, and the field-copying decision and team guidance are documented.