Obtain or build safelist of IP addresses for dynamic WAF

**From incident: [#2025-05-22-multiple-users-blocked](https://docs.google.com/document/d/1keb-FOK1U50c87tB5iSZnXPAq_haxImdbWtM9HLRzE0/edit?tab=t.0)**

## Context

Improve dynamic IP block list that prevents fuzzing attacks and applies to all parts of our application and API.

> After 50 bad requests (like 400/500 error) from an IP address, it gets blocked for 24 hours. This triggers blocking users who will receive a 403 Forbidden error.
>
> Sometimes this is legitimate traffic, blocking SSC egressed IP as some departments who appear to have all its workers accessing the Internet from the same IP address when using the VPN.

## Potential approach

- [ ] Work with SSC to obtain and maintain list
- [ ] Build query to get publicly accessible IP addresses from information store