[BUG] WAF reject rules ignore the configured HTTP status code

### Current Behavior

WAF reject rules expose a configurable `statusCode`, but the HTTP transport status is always set to `403 Forbidden`.

`WafHandle` includes `statusCode` and defaults it to `403`, but `WafPlugin` hardcodes the response status:

```java
exchange.getResponse().setStatusCode(HttpStatus.FORBIDDEN);
Object error = ShenyuResultWrap.error(exchange, Integer.parseInt(wafHandle.getStatusCode()), Constants.REJECT_MSG, null);
```

So a rule configured with another status code only changes the body code, while the actual HTTP status remains 403.

### Expected Behavior

The configured WAF `statusCode` should either be applied to the HTTP response status as well, or the configuration should be removed/renamed so operators do not expect it to control the transport status.

### Impact

Operators cannot return custom reject statuses from WAF rules, and clients can observe inconsistent HTTP status and response body code.

### Code Location

- `shenyu-common/src/main/java/org/apache/shenyu/common/dto/convert/rule/WafHandle.java`
- `shenyu-plugin/shenyu-plugin-waf/src/main/java/org/apache/shenyu/plugin/waf/WafPlugin.java`