A retail company hosts a public e-commerce website behind Azure Application Gateway. The security team wants a centralized way to protect the site from common web-based attacks such as SQL injection and cross-site scripting, without modifying the application code. Which Azure capability should they enable?