feat: per-region + direction CIDR feeds

[bhavink]

Closes #5.

Summary

• Per-region loop in update_outputs.py now emits three variants per region — combined (existing), -inbound, -outbound. The ≥1-CIDR guard applies to each variant independently, so regions that only carry one direction (e.g. aws-eu-north-1, several Azure China/USGov regions) emit just the variant they have.
• 156 new direction-scoped TXT files in docs/output/, all covered by the existing SHA256SUMS manifest (verified locally with sha256sum -c).
• 6 new tests in test_update_outputs.py for emission, per-direction content isolation, the ≥1-CIDR guard, and SHA256SUMS coverage. Full suite: 45/45 passing.
• Docs updated: README.md (Features + Implementation Notes), docs/firewall-automation-guide.md (URL pattern table + concrete use cases), terraform/README.md ("does NOT do" note now points consumers at the published split feeds), and the generated docs/index.html / docs/output/index.html nav copy.

Why

The current <cloud>-<region>.txt files force consumers into a both-directions allowlist even when the target only accepts one direction. Two concrete cases:

• Azure Storage Account network rules — cap is 400 IPs per account; outbound-only ~halves the footprint.
• AWS KMS key policies — aws:SourceIp size-constrained; only outbound CP IPs reach KMS.

Direction-scoped feeds let those consumers tighten the allowlist without forking the repo or post-processing the combined file.

Test plan

• python3 -m pytest -v — 45/45 pass locally
• python3 update_outputs.py — generates expected files
• cd docs/output && sha256sum -c SHA256SUMS — all OK including new files
• Spot-check: aws-us-east-1-inbound.txt contains only inbound CIDRs; aws-us-east-1-outbound.txt contains only outbound; combined aws-us-east-1.txt is the deduplicated union (unchanged)
• Guard verified: aws-eu-north-1-outbound.txt exists, aws-eu-north-1-inbound.txt does not (region has no inbound CIDRs)
• docs/output/index.html lists every new file; existing files unchanged
• CI to re-run tests and verify SHA256SUMS step

Backward compatibility

• All existing files retained (<cloud>.txt, <cloud>-<inbound|outbound>.txt, <cloud>-<region>.txt, all.txt, etc.).
• No changes to file format (one CIDR per line, sorted, deduplicated).
• Terraform module behavior unchanged (it still builds <cloud>-<region>.txt URLs; direction filtering remains an explicit source_files opt-in for now, per the updated note in terraform/README.md).