Add config option to attach a WAF ACL to API Gateway stage(s)

In order to meet the AWS Foundational Security Best Practices we need to have a WAF ACL on our API Gateway stages, but Chalice does not currently support this AFAICT.

https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#fsbp-apigateway-4
```
[APIGateway.4] API Gateway should be associated with an AWS WAF web ACL
Category: Protect > Protective services

Severity: Medium

Resource type: AWS::ApiGateway::Stage

AWS Configrule: api_gw_associated_with_waf

Parameters: None

This control checks whether an API Gateway stage uses an AWS WAF web access control list (ACL). This control fails if an AWS WAF web ACL is not attached to a REST API Gateway stage.
```

Perhaps a new config value could be added (ie. `waf_acl_id`) which could be used to associate a WAF ACL with the API Gateway stage(s) in Chalice.

Start by tracing Chalice's API Gateway stage configuration and deployment entry points, then determine how the proposed waf_acl_id value should apply to one or more stages. Done means a configured WAF ACL is associated with the REST API Gateway stage(s) and the behavior is covered by appropriate tests; the issue does not name specific files or tests.

Written by the indexing model from the issue text.