A company hosts a public-facing e-commerce application behind an Application Load Balancer (ALB) in a VPC. Security auditors require protection against SQL injection and cross-site scripting (XSS) attacks targeting the application's HTTP request payloads, and they also require the ability to block requests from specific countries and enforce rate limits on abusive clients. The security team wants a managed, purpose-built service that inspects Layer 7 HTTP/HTTPS content. Which AWS service should be deployed to meet these requirements with the least operational overhead?