CAShift: Benchmarking Log-Based Cloud Attack Detection under Normality Shift