An e-commerce company hosts a public-facing web application behind Azure Application Gateway. The security team is concerned about common exploits such as SQL injection and cross-site scripting attacks targeting the application's input fields. Which Azure capability should they enable to inspect and filter this malicious HTTP/HTTPS traffic before it reaches the application?