Added support for the NotIpAddress condition operator that allows access when client IP does NOT match specified IP ranges/CIDRs. This complements the existing IpAddress operator with negation logic.