Improve security with Web Application Firewall (WAF) plugin

Allow users to:
- set throttling thresholds globally and per-each-ip
- allow users to subscribe to the AWS managed rule sets:
- [core](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html#aws-managed-rule-groups-baseline-crs)
- [known bad inputs](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html#aws-managed-rule-groups-baseline-known-bad-inputs)
- [IP reputation list](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-ip-rep.html#aws-managed-rule-groups-ip-rep-amazon)
- [anonymous IP list](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-ip-rep.html#aws-managed-rule-groups-ip-rep-anonymous)
- [bot control](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html)
- I think this is only really useful if there are dynamic/non-static plugins (also maybe useful in hard-limits, but maybe not)

Start by reviewing the AWS WAF managed rule-set links in this issue and the project's plugin model, especially the note about dynamic or non-static plugins. Clarify the scope for global and per-IP throttling and each requested managed rule set before implementation. Done means the agreed WAF plugin behavior and supported rule sets are clearly defined.

Written by the indexing model from the issue text.