Add WAF rule to use challenge for public forms

[briri]

See https://docs.aws.amazon.com/waf/latest/developerguide/waf-captcha-and-challenge.html