How to assign an iRule to a profile?

The default behavior of the X-Forwarded-For header in the HTTP profile (at least in our version) includes the IP address of any server in the chain before it hits the web server

That's correct. If an upstream server also sends an XFF header, its value will get merged with the one that the HTTP profile creates. One option would be to simply disable XFF in the HTTP profile and replace the header with an iRule:

when HTTP_REQUEST {
    HTTP::header replace X-Forwarded-For [IP::client_addr]
}

That would effectively remove all other XFF headers form the stream. As for aggregating iRules, when multiple iRules are applied to a VIP, the contents and contexts of each iRule are merged together. If two iRules exists with the same HTTP_REQUEST event, for example, the compilation will contain a single HTTP_REQUEST event with the aggregate code from each individual iRule. You can in fact get yourself in trouble with this sort of thing, but given that you're simply replacing an ingress HTTP header with the above, I doubt you'd ever step on or conflict with any other iRule you added to the VIP.

Adding the above iRule to all of the VIPs on the box would be a pretty straight forward TMSH script.