Adds three scopes to the nawasara/api registry — secscan.ipblock.read,
.write, .delete — and four endpoints under /api/v1/secscan/ip-blocks
(list, show, block, unblock).

Write/delete reuse CloudflareBlockService + the IpBlock model that the
Decision Engine already uses, so an API-driven block is indistinguishable
from an auto-block: it shows in the IP Blocks dashboard, is audited via
api.log, and honours the global dry_run flag (a token cannot bypass it).

The whitelist gate (IpWhitelist::check) runs on write too, so an API token
cannot block the office range, Cloudflare, or search bots. Scopes are split
read/write/delete so a client can be granted view-only, or block-without-unblock.