DataDome: suppress client-side tag for IP-excluded requests

[ChristianPavilonis]

Problem

When a request matches a Trusted Server DataDome IP exclusion, server-side Protection API validation is skipped, but the HTML head injector still emits the DataDome browser tag. The browser can therefore still run client-side bot protection even though the request was explicitly whitelisted for server-side protection.

Proposed behavior

Automatically omit the Trusted Server-injected DataDome client-side tag when the authoritative client IP matches an IP-based protection exclusion. This should cover:

• protection_excluded_ip_cidrs
• Config Store-backed IP CIDR sources
• Structured ip_cidr and ip_cidr_source exclusion rules

This should not require a separate opt-in setting. Non-IP exclusions (path, method, ASN, and query rules) should not automatically suppress the client-side tag. Publisher-originated DataDome tags are out of scope.

Implementation considerations

• Reuse the existing protection-scope decision rather than independently re-evaluating the client IP during HTML injection.
• Carry a request-scoped internal marker from the request filter into the HTML processor/head injector.
• Continue using Fastly's authoritative client IP; do not trust a caller-supplied header.
• Add diagnostic logging showing that the client tag was omitted and why.

Acceptance criteria

• An inline or Config Store IP exclusion skips server-side validation and produces HTML without the Trusted Server DataDome tag.
• A non-excluded IP still receives the tag when configured.
• Non-IP protection exclusions retain current tag-injection behavior.
• Unit tests cover inline CIDRs, dynamic CIDR sources, and the non-IP cases.
• The existing /integrations/datadome/tags.js route remains functional when requested directly.