[WAF] Document encrypted file upload detection and has_encrypted_obj …

[gyx-cf]

Summary

Documents password-protected (encrypted) content detection on the malicious
uploads page, and adds the new cf.waf.content_scan.has_encrypted_obj field.

Content scanning can now detect when a content object is password-protected,
for ZIP archives, RAR archives, PDF files, and Microsoft Office files
(.docx, .doc, .xlsx, .xls, .pptx, .ppt). When it does,
cf.waf.content_scan.has_encrypted_obj is set to true. The content
object's result in cf.waf.content_scan.obj_results is still reported as
not scanned, since the scanner cannot determine whether encrypted content
is malicious, and cf.waf.content_scan.has_failed is not set for encrypted
content.

Changes

• src/content/docs/waf/detections/malicious-uploads/index.mdx
  • Added an Encrypted content section describing the file types
    covered and how the signal is surfaced.
  • Pointed the existing "password-protected" note at the new section.
  • Added cf.waf.content_scan.has_encrypted_obj to the content scanning
    fields table.
• src/content/fields/index.yaml
  • Added the cf.waf.content_scan.has_encrypted_obj entry, which generates
    /ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.has_encrypted_obj/.

Testing

Built locally with pnpm run build (9006 pages, no errors) and confirmed:

• the generated field reference page renders at the expected path
• the #encrypted-content anchor resolves, so the fields-table link and
  the YAML description link both work

pnpm run format:check passes.