feat: global IP/CIDR/UA whitelist bypassing all restrictions

- class-itk-whitelist.php: static class with 5min transient cache,
  supports exact IP, CIDR notation, and ua: prefix for UA substrings
- config/whitelist.conf: editable config file (template with examples)
- whitelist check added to bot-blocker, WAF, protection (4 methods),
  and honeypot validator — matched requests skip all ITK enforcement
- admin: whitelist.conf added to Config Files editor tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

includes/class-itk-bot-blocker.php

@@ -37,6 +37,9 @@ class ITK_Bot_Blocker {
             return;
         }
 
+        // Skip all checks for whitelisted IPs/UAs.
+        if (ITK_Whitelist::allowed()) return;
+
         $options    = get_option('itk_security', []);
         $ua         = $_SERVER['HTTP_USER_AGENT'] ?? '';
         $referrer   = $_SERVER['HTTP_REFERER']    ?? '';