enable Fastly WAF on crates-io web app CDN

[marcoieni]

The crates-io team requested to enable WAF because of bots sending too many requests.

• I asked Fastly to enable WAF on our account.

Related to #1007

[syphar]

short note: ( we're also using the fastly WAF at my dayjob)

after having the WAF active for some time, and ruling out false positives, we actually set up "block always / directly" rules for some signals.

example:
Here someone seemed to have tried to SQL-inject crates.io, through docs.rs search.

HTTP status client error (400 Bad Request) for url (https://crates.io/api/v1/crates?q=1&sort=relevance&per_page=30&seek=W2ZhbHNlLDkuMSwxMzQ1NDU3XQ%27||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||%27)

[syphar]

I'm not sure if some VCL snippets also need to be added to make the edge WAF work.

[ubiratansoares]

I don't have much experience with Fastly, but after some research I learned about NGWAF simulator, and I was wondering whether we could use to experiment and fine tune signals/rules we want to apply 👀

I discussed with @marcoieni and I'm now* aware that we have staging as an option to deploy and test WAF behavior, but eventually something like a simulator speeds a bit the lifecycle for code-test-deploy for any snippets we want to try out.

[syphar]

the default behaviour for the WAF is "don't block, just report",

so you'll be able to inspect the signals in the dashboard before switching the blocking mode on

[marcoieni]

I applied this. Changed the mode to log. Probably we need to change the thresholds as well.