If you're planning on still doing this...
$wgTrustedXffFile = $IP . '/cache/trusted-xff.cdb';
still needs to be changeable.. So define it in extension.json (as false), add a registerExtension callback, and ONLY if it's still false by that point. That goes towards mitigating T100956 for now at least