fix(ruleset): exclude wildcard migration

[ssicard]

Updates cloudflare_ruleset to migrate exclude = ["*"] to
exclude= { all = true }

Provider v4 uses [""] as the exclude-all sentinel. Migrating it to list = [""] changes its meaning in provider v5 instead of preserving exclude-all behavior.

• Integration tests: adds three wildcard rules to the cache_with_reserve fixture in integration/v4_to_v5/testdata/ruleset/:
• E2E drift exemption: adds e2e/drift-exemptions/ruleset.yaml documenting the expected one-time + all = true drift after migration. This drift occurs because the v4 provider stored the wildcard as list = ["*"] in state; the migrated v5 config correctly emits all = true, which differs from the existing API state. It resolves after the first terraform apply.

Testing

========================================
✓ E2E Test Complete!
========================================

Summary:

  Step 1: v4 terraform apply
    Status: ✓ SUCCESS

  Step 2: Migration (v4 → v5)
    Status: ✓ SUCCESS

  Step 3: v5 plan (before apply)
    Status: ✓ SUCCESS - Drift matched exemptions
    Result: 3 material changes (3 matched exemptions, 0 unmatched)
    Terraform: Plan: 0 to add, 1 to change, 0 to destroy.

  Step 4: v5 terraform apply
    Status: ✓ SUCCESS

  Step 5: v5 plan (after apply)
    Status: ✓ SUCCESS - Stable state achieved
    Result: No changes detected

[musa-cf]

Migrating it to list = [""] changes its meaning in provider v5

How does it change the behavior?