A retail company hosts a public e-commerce web application behind Azure Application Gateway. The security team is concerned about common web-based attacks such as SQL injection and cross-site scripting (XSS) targeting the application. Which Azure security capability should they enable to protect the application against these threats?