Geo with country and region through ctx.geo() on Cloudflare #480

Summary

Geo with country and region through ctx.geo() on Cloudflare.

Behavior

ctx.geo() gives country and region. Fastly keeps its existing geo. Axum uses CloudFront geo from #439, bound from EdgeZero's manifest so an application reads ctx.geo() without its own boot profile (EZI-4a). Cloudflare reads its request metadata (EZI-4c). Spin, whose requests carry no geo, reads a trusted ingress header the platform sets or a KV- or API-backed provider (EZI-4s, as IABTechLab/trusted-server#1518 describes for WASM targets).

Acceptance criteria

• A US request on Cloudflare and on Spin reports country and region, and Axum's geo loads with no Trusted Server geo setting

Dependencies

Blocked by:

• Axum: add protected CloudFront Geo metadata provider #432 Axum: add protected CloudFront Geo metadata provider

Blocks:

• Integration-branch tag with the Cloudflare parts #492 Integration-branch tag with the Cloudflare parts (new in this plan)

Related

• Needed by Server-side identity on every adapter trusted-server#1558, server-side identity on every adapter. Planned in wave 10 (after the MVP: Cloudflare); priority P2, size S.
• Requirement EZI-4 in the design.