Warn about path matching in rate limiting

### Existing documentation URL(s)

https://developers.cloudflare.com/waf/rate-limiting-rules/best-practices/#protecting-against-credential-stuffing

### What changes are you suggesting?

https://developers.cloudflare.com/waf/rate-limiting-rules/best-practices/#protecting-against-credential-stuffing (and other sections in this page too) recommends rate limiting based on the path:

> Hostname equals `example.com` and URI Path equals `/login` and Request Method equals `POST`

But this practice isn't always fully robust. Path manipulation or mangling can lead to policy bypass ([^1], [^2]). I believe it would be worth mentioning these potential shortcomings if using this solution, and maybe also link to [how CF applies normalization](https://developers.cloudflare.com/rules/transform/examples/normalize-encoded-slash/).

[^1]: https://clement.notin.org/blog/2016/07/13/CVE-2016-5007-Spring-Security-MVC-Path-Matching-Inconsistency/
[^2]: https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf

### Additional information

_No response_