A company runs a single-region web application on Azure VMs behind a public endpoint in the East US region. Security requires that all inbound HTTPS traffic be inspected by a Layer 7 web application firewall, that TLS be terminated and re-encrypted to the backend pool, and that requests be routed based on URL path to different VM pools. The solution must stay within one region and must not introduce a global anycast entry point. Which service should you recommend?