Enable WAF for the API Gateway

[dseichter]

Is your feature request related to a problem? Please describe.
To improve the security of the API Gateway, we should have WAF enabled on the API Gateway.

Describe the solution you'd like
Every request should only by allowed, if the necessary payload is included. Additional (optional) rule should be added, if someone want to deploy it into a network, which makes IP whitelisting necessary.

Additional context
Enabling WAF should be an optional part, because of keep an eye on the costs, especially for test environments.