there is more to it than the user-agent string - there are several associated config vars which affect that cloudflare browser check - i have been patching icecat like so, since 2021, specifically to fix this problem
https://git.parabola.nu/~bill-auger/icecat.git/commit/?h=do-not-spoof-useragent&id=1351954b2fba37cec9262e970a84ce0d7b62df1d in short, the solution is to "do nothing" - do not attempt to override the defaults - parabola used to do the same for iceweasel, until this problem appeared and the cause was identified - after some discussion, we agreed that the generic configuration is the most desirable anyways; because as you noted regarding the tor button, the best way to thwart fingerprinting is to appear to be as generic as possible
