Update WAF to allow the blocking of problematic IPs

[briri]

We should update our WAF rules so that it allows for an IP black list.

See conversation in this ticket

[marisastrong]

I added a rule in Outlook for the [email protected] to manage the problem reported in https://github.com/cdlib/cdlsys/issues/635

[briri]

sample rule:

- Action:
    Block: {}
  Name: rate-limit
  Priority: ?
  Statement:
    RateBasedStatement:
      AggregateKeyType: IP
      Limit: ?
      ScopeDownStatement:
        RegexMatchStatement:
          FieldToMatch:
            UriPath: {}
          RegexString: (^\/contacts|^\/users/sign_in|^\/users/sign_up|^\//users/password/new|^\/$)
          TextTransformations:
          - Priority: 0
            Type: NONE
  VisibilityConfig:
    CloudWatchMetricsEnabled: true
    MetricName: rate-limit
    SampledRequestsEnabled: true