Always-on detections: eliminating the WAF “log versus block” trade-off

Introduces Attack Signature Detection and Full-Transaction Detection for Cloudflare's WAF. Attack Signature Detection separates detection from mitigation, running all signatures on every request to enrich analytics and provide metadata for custom policies. It categorizes signatures by attack vector and confidence level (High, Medium). Full-Transaction Detection correlates request and response data to reduce false positives and uncover subtle threats. The post details how these detections populate fields like `cf.waf.signature.request.confidence`, `cf.waf.signature.request.categories`, and `cf.waf.signature.request.ref` for use in Security Analytics and the Edge Rules Engine. It also explains how the "always-on" framework can execute detections after the request is sent to the origin to avoid introducing latency.