Turning Cloudflare’s threat indicators into real-time WAF rules

Introduces new WAF fields (`cf.intel.ip.attacker_names`, `cf.intel.ip.target_industries`, `cf.intel.ip.attacker_countries`, `cf.intel.ip.target_countries`, `cf.intel.ip.datasets`) that allow WAF rules to be written using live threat intelligence data. This enables proactive blocking of known bad actors, targeting specific industries or countries, and filtering by attack type. The feature leverages an 'always-on detection framework' for real-time enrichment of HTTP request analytics with threat metadata. It integrates with WAF custom rules and rate limiting, accessible via API and Terraform, and logs matches in Security Analytics. Threat intelligence datasets are compressed and distributed globally for O(1) lookups, and the engine evaluates multiple signals simultaneously for multi-vector actors.