Fix BlockIP visibility and IndexBot method in Api

[VitalD]

Summary

• Make Api::BlockIP public — it is called from WAFSystem when isBas is detected; as private this throws a PHP error and the BAS block path never blacklists the IP.
• Replace IndexBot::isIndexbot() with IndexBot::Checking() — isIndexbot does not exist; with indexbot_checker enabled the same path fatals on an undefined method.

Context

When data['isBas'] is true, WAFSystem::isAllowed2 does:

$Api->BlockIP($this->Profile->IP, "BAS browser detected or old driver Mozilla");
$Api->endJSON('block');

Observed on current master (includes/Api.class.php).

Test plan

• Trigger BAS/isBas=true path via xhr.php func=checks with IndexBot disabled — expect JSON block and IP added to blacklist (no PHP Error about private method).
• Same with indexbot_checker.enabled = On for a non-indexer IP — expect blacklist + block (no undefined isIndexbot).
• Same for a real indexer PTR that Checking() accepts — expect no blacklist add, still block response from caller.
• Normal allow / captcha flows unchanged.