Enhancement: Visitor IP behind Cloudflare WAF setting

### Impacted plugin

Protect

### What

The Brute Force Protection feature should have a Cloudflare setting to properly detect the visitor's IP when the request is coming from Cloudflare's WAF.

### How

As noted in [Cloudflare's documentation](https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/), their WAF sends requests to sites with a custom `HTTP_CF_CONNECTING_IP` header. This header contains the visitor's IP since the `REMOTE_ADDR` header contains the IP of Cloudflare's server.

The linked documentation contains many ways to configure the server to automatically correct the `REMOTE_ADDR` header, but many of these options are beyond the scope of what a user can configure on the server. Looking at [Cloudflare's plugin](https://wordpress.org/plugins/cloudflare/), they have a section of code that sets both the `REMOTE_ADDR` and `HTTP_X_FORWARDED_FOR` headers to the `HTTP_CF_CONNECTING_IP` header's value if a request is coming from a Cloudflare WAF IP.

It would be nice if Jetpack Protect could do something similar. Since doing the IP comparison for every request on sites not behind Cloudflare's WAF is needlessly-expensive, a toggle setting to enable detection may be appropriate.

Start with Jetpack Protect's Brute Force Protection feature and review Cloudflare's visitor-IP documentation and plugin behavior. Define a setting that enables Cloudflare WAF detection, then verify that requests use the visitor IP from HTTP_CF_CONNECTING_IP only when appropriate while ordinary requests remain unaffected.

Written by the indexing model from the issue text.