fix(cdn): declare the User-Agent cache vary instead of dropping it (#156)

## Problem

`tofu plan` after importing the middleware script shows:

```
  ~ resource "bunnynet_pullzone" "cran_rpkgs_com" {
      ~ cache_vary_headers = [
          - "User-Agent",
        ]
```

The zone carries `cache_vary_headers = ["User-Agent"]`, set before this configuration existed. `cdn.tf` never declared it, so the first apply of the managed middleware would remove it — as a side effect of an unrelated change, with no decision recorded anywhere.

## What this changes

Declares the attribute with its current value, so the pull zone is a no-op in that plan.

## Why keep it rather than let it go

On paper the router makes it redundant. The only UA-dependent responses it produces are redirects, and those carry `Cache-Control: no-store`; their targets are concrete per-slot, per-minor URLs whose content depends only on the path. Dropping the vary would also be a genuine win, since otherwise every distinct R version string (`R (4.5.3 x86_64-pc-linux-musl …)`) keys its own copy of every tarball.

It stays anyway, for now:

- it is the second line of defence against the one failure mode that would be quiet and confusing — an R 4.6 client served the 4.5 index
- Bunny honouring `no-store` on an edge-script response has been confirmed for today's redirects (`cdn-cache: BYPASS` on `max-age=0`), but not for the new script in production
- keeping it is the status quo, so it cannot regress anything

Removing it is worth doing on its own, once per-minor routing is confirmed live and the redirects can be observed bypassing cache — not as a side effect of enabling that routing.

## Verification

`tofu validate` passes. Re-planning after this merges should leave `bunnynet_pullzone.cran_rpkgs_com` unchanged, reducing the plan to the script `content` update and the new `UNION_SLOTS` variable.

Reviewed-on: #156

cdn.tf

@@ -105,6 +105,21 @@ resource "bunnynet_pullzone" "cran_rpkgs_com" {
   request_coalescing_enabled = true
   block_post_requests        = true
 
+  # Set on the zone since before this configuration existed; declared here so
+  # `tofu apply` stops silently removing it.
+  #
+  # The router makes it redundant on paper: the only UA-dependent responses it
+  # produces are redirects, and those carry `Cache-Control: no-store`, while
+  # their targets are concrete per-slot, per-minor URLs whose content depends
+  # only on the path. Dropping it would also be a real win, because otherwise
+  # every distinct R version string keys its own copy of every tarball.
+  #
+  # It stays for now anyway: it is the second line of defence against the one
+  # failure that would be quiet and confusing (an R 4.6 client served the 4.5
+  # index), and removing it is worth doing on its own once per-minor routing is
+  # confirmed live, not as a side effect of enabling that routing.
+  cache_vary_headers = ["User-Agent"]
+
   limit_requests    = 5000
   limit_connections = 1000