feat(cloudflare): Add Cloudflare provider with zones service and critical security checks

[HugoPBrito]

Context

This PR introduces the Cloudflare provider to Prowler, enabling security assessments for Cloudflare-managed infrastructure. This is part 1 of 4 PRs that will add complete Cloudflare support.

1. This one
2. https://github.com/prowler-cloud/prowler/pull/9424
3. https://github.com/prowler-cloud/prowler/pull/9425
4. https://github.com/prowler-cloud/prowler/pull/9426

Description

Adds the Cloudflare provider with core infrastructure and 5 critical security checks:

Core Infrastructure:

• CloudflareProvider with API token authentication
• Zones service for fetching zone configurations (SSL settings, DNSSEC, security headers)
• CLI integration (parser arguments, outputs, HTML reports)
• Mutelist support and configuration files
• Exception handling and service base classes

Critical Security Checks (5):

Check	Description
zones_ssl_strict	Ensures SSL/TLS encryption mode is set to Full (Strict)
zones_min_tls_version_secure	Validates minimum TLS version is 1.2 or higher
zones_dnssec_enabled	Validates DNSSEC is enabled for the zone
zones_https_redirect_enabled	Ensures automatic HTTPS redirect is enabled
zones_hsts_enabled	Validates HTTP Strict Transport Security is enabled

Steps to review

1. Review the provider structure in prowler/providers/cloudflare/
2. Verify CLI integration in prowler/lib/cli/parser.py
3. Check the zones service implementation in prowler/providers/cloudflare/services/zones/
4. Review each of the 5 security checks for correctness
5. Test locally with a Cloudflare API token:

   prowler cloudflare --api-token <token>
   

Checklist

• Are there new checks included in this PR? Yes
  • If so, do we need to update permissions for the provider? No - uses standard Cloudflare API token permissions
• [x] Review if the code is being covered by tests.
• [x] Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• [ ] Review if backport is needed.
• [ ] Review if is needed to change the Readme.md
• [ ] Ensure new entries are added to CHANGELOG.md, if applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[github-actions[bot]]

⚠️ Changes detected in the following folders without a corresponding update to the CHANGELOG.md:

• api
• prowler

Please add an entry to the corresponding CHANGELOG.md file to maintain a clear history of changes.

[github-actions[bot]]

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

[github-actions[bot]]

🔒 Container Security Scan

Image: prowler-api:bda0fba Last scan: 2025-12-16 11:44:00 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	4
Total	4

3 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

• Review the detailed scan results
• Update affected packages to patched versions
• Consider using a different base image if updates are unavailable

---

📋 Resources:

• Download full report (see artifacts)
• View in Security tab
• Scanned with Trivy

[github-actions[bot]]

🔒 Container Security Scan

Image: prowler:bda0fba Last scan: 2025-12-16 11:45:10 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	3
Total	3

3 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

• Review the detailed scan results
• Update affected packages to patched versions
• Consider using a different base image if updates are unavailable

---

📋 Resources:

• Download full report (see artifacts)
• View in Security tab
• Scanned with Trivy

[codecov[bot]]

Codecov Report

:x: Patch coverage is 30.88235% with 47 lines in your changes missing coverage. Please review. :white_check_mark: Project coverage is 87.00%. Comparing base (bfce602) to head (c612637). :warning: Report is 53 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9423      +/-   ##
==========================================
- Coverage   92.95%   87.00%   -5.95%     
==========================================
  Files         126     1657    +1531     
  Lines        3024    69571   +66547     
==========================================
+ Hits         2811    60532   +57721     
- Misses        213     9039    +8826     

Flag	Coverage Δ
api	92.43% <ø> (?)
prowler-py3.10-aws	90.60% <ø> (?)
prowler-py3.10-azure	89.82% <ø> (?)
prowler-py3.10-config	84.35% <30.88%> (?)
prowler-py3.10-gcp	90.12% <ø> (-2.84%)	:arrow_down:
prowler-py3.10-github	89.37% <ø> (?)
prowler-py3.10-iac	89.01% <ø> (?)
prowler-py3.10-kubernetes	89.75% <ø> (?)
prowler-py3.10-lib	84.37% <29.85%> (?)
prowler-py3.10-m365	89.28% <ø> (?)
prowler-py3.10-mongodbatlas	88.90% <ø> (?)
prowler-py3.10-nhn	89.31% <ø> (?)
prowler-py3.10-oraclecloud	86.54% <ø> (?)
prowler-py3.11-aws	90.53% <ø> (?)
prowler-py3.11-azure	89.77% <ø> (?)
prowler-py3.11-config	84.31% <30.88%> (?)
prowler-py3.11-gcp	90.07% <ø> (-2.89%)	:arrow_down:
prowler-py3.11-github	89.32% <ø> (?)
prowler-py3.11-iac	88.96% <ø> (?)
prowler-py3.11-kubernetes	89.70% <ø> (?)
prowler-py3.11-lib	84.34% <29.85%> (?)
prowler-py3.11-m365	89.24% <ø> (?)
prowler-py3.11-mongodbatlas	88.86% <ø> (?)
prowler-py3.11-nhn	89.27% <ø> (?)
prowler-py3.11-oraclecloud	86.50% <ø> (?)
prowler-py3.12-aws	90.60% <ø> (?)
prowler-py3.12-azure	89.83% <ø> (?)
prowler-py3.12-config	84.35% <30.88%> (?)
prowler-py3.12-gcp	90.13% <ø> (-2.83%)	:arrow_down:
prowler-py3.12-github	89.37% <ø> (?)
prowler-py3.12-iac	89.01% <ø> (?)
prowler-py3.12-kubernetes	89.75% <ø> (?)
prowler-py3.12-lib	84.38% <29.85%> (?)
prowler-py3.12-m365	89.28% <ø> (?)
prowler-py3.12-mongodbatlas	88.91% <ø> (?)
prowler-py3.12-nhn	89.32% <ø> (?)
prowler-py3.12-oraclecloud	86.55% <ø> (?)
prowler-py3.9-aws	90.61% <ø> (?)
prowler-py3.9-azure	89.83% <ø> (?)
prowler-py3.9-config	84.35% <30.88%> (?)
prowler-py3.9-gcp	90.13% <ø> (-2.83%)	:arrow_down:
prowler-py3.9-github	89.38% <ø> (?)
prowler-py3.9-iac	89.01% <ø> (?)
prowler-py3.9-kubernetes	89.76% <ø> (?)
prowler-py3.9-lib	84.38% <29.85%> (?)
prowler-py3.9-m365	89.29% <ø> (?)
prowler-py3.9-mongodbatlas	88.91% <ø> (?)
prowler-py3.9-nhn	89.32% <ø> (?)
prowler-py3.9-oraclecloud	86.55% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
prowler	84.38% <30.88%> (-8.58%)	:arrow_down:
api	92.43% <ø> (∅)

:rocket: New features to boost your workflow:

• :snowflake: Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• :package: JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.