Contoso hosts a global web application behind Azure Front Door for content delivery and TLS termination at the edge. The security team wants to block SQL injection and cross-site scripting attacks as close to the user as possible, before requests traverse the backbone to regional origins. They also require the WAF policy to protect all edge endpoints regardless of which backend serves the request. Which WAF deployment approach meets these requirements?