block_ips was hardcoded in both pullzones as a single IP
("185.172.53.0"). Move it to a variable so updates don't require
editing the resource bodies (and so a future for_each refactor
doesn't bake the list into the map).
Default keeps the existing entry; no plan diff on apply.