Review WAF rules for failure responses and amount of time blocked

**From incident: [#2025-05-22-multiple-users-blocked](https://docs.google.com/document/d/1keb-FOK1U50c87tB5iSZnXPAq_haxImdbWtM9HLRzE0/edit?tab=t.0)**

## Context

To prevent other similar situations or scenarios where this could happen again.
- Avoiding the API hit with bad requests with a developer trying to authenticate through API

> After 50 bad requests (like 400/500 error) from an IP address, it gets blocked for 24 hours. This triggers blocking users who will receive a 403 Forbidden error.

We have 2 different WAFs running: API server and app, IdP done directly with Zitadel for token generation.

- Exclude failure response with rule, 403/500 users not blocked → does this allow brute force attack?
- Include the session ID, modify dynamic IP blocking with shorter period of time