docs: select Cloudflare CDN for Artifact Registry on GitLab.com

What

Change the GitLab.com (SaaS) CDN choice in ADR-006 from Google Cloud CDN to Cloudflare CDN, and document the rationale, trade-off, and the historical Cloudflare buffering issue. Self-Managed guidance is updated to list AWS CloudFront and Google Cloud CDN as supported options.

Why

The Artifact Registry runs under a Cellular Architecture where Cells will multiple buckets, and potentially multiple Cloud Providers. Google Cloud CDN cannot front S3 origins, so it cannot serve as a single CDN layer across the Cell fleet without maintaining two configurations. Cloudflare CDN supports both origins under one configuration.

Cloudflare is already the planned edge for WAF rules and IP-based rate limiting on this service. Reusing it for caching keeps caching, WAF, and rate-limiting policy in one control plane and avoids running a parallel Google Cloud CDN layer solely for caching.

The historical note captures why Cloudflare proxying was disabled for registry.gitlab.com in 2022 (request-body buffering caused the 15-minute JWT to expire on large PATCH blob uploads) and the January 2026 request_body_buffering: none fix that makes the new design viable.

Assisted-by: Claude:claude-opus-4-7