refactor: hoist CDN block_ips to a variable (#81)

## Summary

`block_ips = ["185.172.53.0"]` was duplicated in both `bunnynet_pullzone` resources in `cdn.tf`. Move it to a typed `cdn_block_ips` variable in `vars.tf` with the existing IP as the default.

- No plan diff on apply — same value, just sourced from `var.cdn_block_ips` instead of a literal.
- Adding/removing IPs is now a one-line var override (or a default change) instead of two edits in the resource bodies.

## Interaction with #80 (for_each refactor)

`#80` collapses the two pullzones to `bunnynet_pullzone.this[for_each]`. Either order works; whichever lands second is a trivial one-line rebase on the surviving `block_ips =` line.

Reviewed-on: #81

cdn.tf

@@ -32,9 +32,7 @@ resource "bunnynet_pullzone" "devxy-r-binaries" {
   cache_stale           = ["offline", "updating"]
   use_background_update = true
 
-  block_ips = [
+  block_ips = var.cdn_block_ips
-    "185.172.53.0"
-  ]
 
   # 50 TB
   limit_bandwidth = 50000000000000
@@ -86,9 +84,7 @@ resource "bunnynet_pullzone" "cran_rpkgs_com" {
   cache_stale           = ["offline", "updating"]
   use_background_update = true
 
-  block_ips = [
+  block_ips = var.cdn_block_ips
-    "185.172.53.0"
-  ]
 
   # 50 TB
   limit_bandwidth = 50000000000000

vars.tf

@@ -17,3 +17,11 @@ variable "B2_S3_SECRET_KEY" {
   type      = string
   sensitive = true
 }
+
+variable "cdn_block_ips" {
+  description = "IP addresses to block at the BunnyCDN pullzones (cran.devxy.io, cran.rpkgs.com)."
+  type        = list(string)
+  default = [
+    "185.172.53.0",
+  ]
+}