[Support Feedback] Improve IUAM, DDoS triage, and origin protection docs (DDoS Protection)

[dmmulroy]

Summary

Expands DDoS protection documentation for common support topics, based on an audit of active support macros.

Changes

• I'm Under Attack Mode (IUAM): Document configuration options, expected visitor experience, and when to use vs. alternatives
• DDoS response triage: Add a checklist for customers experiencing an active attack (what to collect, what to configure, when to escalate)
• Origin protection: Explain why Cloudflare IPs appear in origin server logs and how to restore original visitor IPs

Context

These changes are driven by recurring support cases. If you want to see the underlying support data (macro frequency, case volume by topic), reach out to @dmmulroy internally.