feat: add Authenticated Origin Pulls (AOP) certificate metrics

**What**
Add new metrics from the Cloudflare AOP REST API:
- `cloudflare_zone_aop_global_enabled` — whether global AOP is enabled at the zone level
- `cloudflare_zone_aop_enabled` — whether zone-level AOP is enabled
- `cloudflare_zone_aop_certificate_status` — status of uploaded AOP certificates (active, pending_deployment, expired, etc.)
- `cloudflare_zone_aop_certificate_expiry` — certificate expiry date as a Unix timestamp
-
**Why**
There is currently no way to monitor AOP certificate status or expiry via the exporter. Enterprise customers (e.g. Workday) use the exporter for observability and want to alert on expiring or inactive AOP certificates — the same way `cloudflare_zone_certificate_validation_status` covers edge certs today.

**API**
Available via existing REST endpoints, no new permissions required — `SSL and Certificates: Read` is already in the recommended token:
- `GET /zones/{zone_id}/settings/tls_client_auth` — global AOP enabled state
- `GET /zones/{zone_id}/origin_tls_client_auth/settings` — zone-level AOP enabled state
- `GET /zones/{zone_id}/origin_tls_client_auth` — zone-level certificate status and expiry
- `GET /zones/{zone_id}/origin_tls_client_auth/hostnames/certificates` — per-hostname certificate status and expiry

Start by locating the existing cloudflare_zone_certificate_validation_status metric and the REST client paths used for zone settings. Review the four AOP endpoints listed in the issue, then add metrics for global and zone enablement plus certificate status and expiry, including hostname certificates. Done means all listed metric names expose the corresponding API values.

Written by the indexing model from the issue text.