How I can limit my role trust policy to a corporate CIDR range?

There is also a key called "aws:SourceVpce" but it can only be used for communication via a VPC endpoint. Therefore, by connecting the on-premises environment to the VPC using a VPN or similar method, creating VPC endpoints for IAM and STS, and enabling access from GitLab to those VPC endpoints, it should be possible. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_interface_vpc_endpoints.html

Your private IPs are only visible inside your private network. If you call an AWS API endpoint on the public internet, you won't be sending the request over the internet from your private IP. You'll be sending it from a public NAT address of your corporate firewall, and that's the IP you'll be showing to AWS. As Riku Kobayashi correctly explained, you'll either need to put your internet-facing NAT addresses of your firewall in the aws:SourceIp condition clause, or set up VPC endpoints reachable from your internal network and use aws:SourceVpc or aws:SourceVpce to restrict access.

The phrase "corporate address range" in the document is quite correct but it refers to the IP addresses your corporation uses to connect to the relevant AWS service endpoint. Usually, you'll do that over the public internet, and the corporate address range is the public IP or range of them used for NATing on your firewall. You can also do it over an internal network connection, such as over a VPN, to a VPC with the relevant endpoint, but in general, that's a relatively advanced and unusual setup that you'd know about.