Since Cloudflare adds and manages the /cdn-cgi/ endpoint, it makes more sense to address this on their side with a X-Robots-Tag: noindex, nofollow response header.
Adding this header via a custom Response Header Transform Rule does not work, since (again) Cloudflare manages this endpoint and does not allow any alterations (which makes sense).
Since Cloudflare adds and manages the /cdn-cgi/ endpoint, it makes more sense to address this on their side with a X-Robots-Tag: noindex, nofollow response header.
Adding this header via a custom Response Header Transform Rule does not work, since (again) Cloudflare manages this endpoint and does not allow any alterations (which makes sense).