W-22208971 eCDN rate limiting and fire wall rules

[charithaT07]

##Summary

Adds CLI commands for managing eCDN custom firewall rules and rate-limiting rules.

b2c ecdn firewall

• list — list rules in a zone (Rule ID shown in default table)
• get — fetch a single rule by ID
• create — create a rule with --description, --expression, --actions, optional --before / --after positioning
• update — partial update; rejects empty patches
• delete — requires --force, goes through the destructive-action safety guard
• reorder — update full evaluation order via --rule-ids (csv) or --rule-ids-file (JSON array)

b2c ecdn rate-limit

• list, get, create, update, delete — same shape as above but for rate-limiting rules, with rate-limit-specific flags (--period, --requests-per-period, --mitigation-timeout, --characteristics).

All commands extend EcdnZoneCommand so --tenant-id, --short-code, --zone, and --json behave consistently with the rest of the eCDN topic. Read commands use cdn-zones scope; write commands use cdn-zones.rw.

Tests

• 24 unit tests for firewall, 18 for rate-limit
• Cover happy path, validation rejections (empty patches, duplicates, missing required inputs), and API error paths
• Same mocking pattern as the existing eCDN tests

Docs & changeset

• New Custom Firewall Rules section in docs/cli/ecdn.md with flag tables and example workflows
• Workflow tip added to the Rate Limiting section
• New skills/b2c-cli/skills/b2c-ecdn/SKILL.md
• Minor bump for @salesforce/b2c-cli

Test plan

• Unit tests pass (pnpm -F b2c-cli test:agent)
• Lint and typecheck clean
• b2c ecdn firewall --help and b2c ecdn rate-limit --help show the new commands
• b2c ecdn firewall list returns rules from a real zone (read-only check)
• Live CRUD smoke test on a non-production tenant — planned with disposable rules (cli-smoke-* description, .invalid host expression, --no-enabled), not yet run

Dependencies

• No net-new third-party dependencies were added
• If net-new third-party dependencies were added, rationale/discussion is included and 3pl-approved is set by a maintainer

---

• Tests pass (pnpm test)
• Code is formatted (pnpm run format)