Add support for multiple IP Addresses found in X-Forwarded-For request header

This should likely not be merged without making this behavior optional (and adding a warning about enabling it). From the getClientIps() method documentation:

     * In the returned array the most trusted IP address is first, and the
     * least trusted one last. The "real" client IP address is the last one,
     * but this is also the least trusted one. Trusted proxies are stripped.
     *
     * Use this method carefully; you should use getClientIp() instead.

https://github.com/symfony/symfony/blob/6.2/src/Symfony/Component/HttpFo...

We considered using this patch for a client using Akamai but aren't comfortable with the security risk associated with trusting all addresses in X-Forwarded-For.

Marking this as "needs work" based on my concern above. An more secure approach is to add trusted proxy addresses to settings.php using $settings['reverse_proxy_addresses']. When these are set, Drupal will strip those addresses from X-Forwarded-For, leaving the client's real IP as the only one in the header. Drupal will trust that IP as long as the request was received from a trusted proxy. This does mean that list must be maintained as the CDN changes those addresses.

The Restrict by IP module allows you to configure the header that contains the client's real IP. This is often configured on the CDN (sometimes called "True-Client-IP") and can be trusted by Drupal when that is the case. We are working on a patch for this module to add the same functionality and will post it in a separate issue.