feat: cloud armor - upgrade preconfigured waf list to v33

[davelanglois-ssc]

update cloud armor policy to use v33 of preconfigured waf rules. All lists are using distinct rules.

• lfi-v33-stable
• rfi-v33-stable
• rce-v33-stable
• methodenforcement-v33-stable
• scannerdetection-v33-stable
• protocolattack-v33-stable
• sessionfixation-v33-stable
• xss-v33-stable

The list below are not included in this example as they are more application specific and will be evaluated on a per application basis

• nodejs-v33-stable
• java-v33-stable
• php-v33-stable
• sqli-v33-stable
• cve-canary(Apache Log4j CVE-2021-44228)
• json-sqli-canary(JSON-formatted content SQLi)

credit to Yan Bellerose for this repository https://github.com/ybellerose/GCP-Cloud-Armor/tree/main

closes #730

[davelanglois-ssc]

@ybellerose I would appreciate your input on this PR

[ybellerose]

/lgtm Rules as-is will work. observation: you could prepare the rules for the tuning phase by adding the severity level and the opt-out list. Such as: evaluatePreconfiguredWaf('xss-v33-stable', {'sensitivity': 4, 'opt_out_rule_ids': []})

Results is the same as the actual configuration, simply prepare for the next stage when opt-out rule will be required by some application.