refactor: hoist CDN block_ips to a variable

block_ips was hardcoded in both pullzones as a single IP
("185.172.53.0"). Move it to a variable so updates don't require
editing the resource bodies (and so a future for_each refactor
doesn't bake the list into the map).

Default keeps the existing entry; no plan diff on apply.

vars.tf

@@ -17,3 +17,11 @@ variable "B2_S3_SECRET_KEY" {
   type      = string
   sensitive = true
 }
+
+variable "cdn_block_ips" {
+  description = "IP addresses to block at the BunnyCDN pullzones (cran.devxy.io, cran.rpkgs.com)."
+  type        = list(string)
+  default = [
+    "185.172.53.0",
+  ]
+}