enabling WAF for preprod and prod

[stevomcallister]

Context

Changes in this PR

Screenshots of UI changes

Before

After

Release checklist

Release process documentation

As part of our continuous deployment strategy we must ensure that this work is
ready to be released once merged.

Pre-merge

• There are changes required to the Accredited Programmes API for this change to work...
  • ... and they have been released to production already

Post-merge

• This adds, extends or meaningfully modifies a feature...
  • ... and I have written or updated an end-to-end test for the happy path in the Accredited Programmes E2E repo
• This makes new expectations of the API...
  • ... and I have notified the API developer(s) of changes to the contract tests (Pact), or the API is already compliant
• Manually approve release to preprod
• Manually approve release to prod