The `request.cloudflare?` method can be used in a Rack::Attack blocklist rule
to block traffic that hasn't passed through CloudFlare.

For instance:

```ruby
  Rack::Attack.blocklist('CloudFlare WAF bypass') do |req|
    !req.cloudflare?
  end
```

Note that the request may optionally pass through additional trusted
proxies, so it will return true for any of these scenarios:

* `REMOTE_ADDR` = CloudFlare
* `REMOTE_ADDR` = *trusted_proxy*, `X_HTTP_FORWARDED_FOR` = CloudFlare,...
* `REMOTE_ADDR` = *trusted_proxy*, `X_HTTP_FORWARDED_FOR` = *trusted_proxy2*,CloudFlare,...

but it will return false if CloudFlare comes after the trusted prefix of
`X-Forwarded-For`.

* Break up tests to only have one expectation per spec
* Reduce line lengths