Block admin public endpoints

[saranggalada]

Goal: On the public KMS hostname, only client key flows stay open; admin and platform routes must go through private access (VNet / ledger private FQDN).

What changes:

• Application Gateway WAF is set to Prevention (via locals.tf) so rules are enforced.
• force_firewall_policy_association = true so the WAF policy is reliably applied.
• Custom rules:
  • Allow GET /app/pubkey (BeginsWith), GET allowlist regex for listpubkeys, POST paths for key / unwrapKey (fmt preserved).
  • Block any other /app/... (admin APIs: heartbeat, refresh, proposals, policies, etc.).
  • Block /node/..., /gov/..., /receipt... so CCF ledger surfaces aren’t exposed on the public listener.
• OWASP CRS: selectively disable 942340 / 942430 / 942440 on this policy so legitimate KMS JSON/key/unwrapKey POSTs aren’t tripped before enforcement.