Proxy Geo secondary HTTP pushes + lfs through Workhorse

As the secondary is read-only, we want to ensure pushes are proxied
to the primary, while reads are served localy, same with LFS files.

Changelog: changed
EE: true