Add DataDome decision logging and IP-exclusion tag suppression

[ChristianPavilonis]

Summary

• Add structured DataDome protection decision logs without logging client IP values.
• Suppress Trusted Server's automatically injected DataDome client tag for Fastly requests matching an IP-based exclusion.
• Keep publisher-originated tags and direct DataDome integration routes unchanged.

Changes

• Add a typed request marker for inline CIDRs, Config Store CIDR sources, and structured ip_cidr / ip_cidr_source exclusions.
• Propagate the marker through publisher HTML processing, including buffered and streaming paths.
• Mark suppressed processed HTML private, max-age=0 and remove shared surrogate-cache headers.
• Preserve normal tag injection for ASN, method, path, query, internal-route, unmatched, and fail-open cases.
• Document the behavior and add regression coverage for exclusion matching, propagation, tag suppression, cache privacy, and request annotations.
• Remove client IP fields from DataDome logs; the IP remains available for protection decisions and DataDome API payloads.

Closes

Closes #994

Test plan

• cargo test-fastly
• cargo test-axum
• cargo test-cloudflare
• cargo clippy-fastly
• cargo clippy-axum
• cargo clippy-cloudflare
• cargo fmt --all -- --check
• Docs Prettier check
• git diff --check
• Live production/browser verification (deferred until deployment)

Checklist

• Changes follow CLAUDE.md conventions
• No secrets or credentials committed
• New behavior has tests