Add WAF policy compile instructions

[ADubhlaoich]

Proposed changes

This PR is for a document describing how to use NGINX Instance Manager to compile policies for NGINX App Protect WAF for use with NGINX Ingress Controller.

Jason Williams is the author: I am editing and converting it for documentation. The first commit is largely the rough draft initially provided

Checklist

Before creating a PR, run through this checklist and mark each as complete.

• I have read the CONTRIBUTING doc
• I have added tests that prove my fix is effective or that my feature works
• I have checked that all unit tests pass after adding my changes
• I have updated necessary documentation
• I have rebased my branch onto main
• I will ensure my PR is targeting the main branch and pulling from my branch from my own fork

[ADubhlaoich]

@jasonwilliams14 Unless there's a technical requirement for it, I don't think uploading the bundle to the cluster makes sense as the last step. Since it's referenced in the policy created, I think that step should go immediately after the necessary volume and volumeMounts are created.

Right now the steps assert that you reference a binary file that doesn't exist within the cluster on the premise of adding it later: since the user will have created and downloaded the bundle already, I think it's better they upload it immediately.

[brianehlert]

@jasonwilliams14 Unless there's a technical requirement for it, I don't think uploading the bundle to the cluster makes sense as the last step. Since it's referenced in the policy created, I think that step should go immediately after the necessary volume and volumeMounts are created.

Right now the steps assert that you reference a binary file that doesn't exist within the cluster on the premise of adding it later: since the user will have created and downloaded the bundle already, I think it's better they upload it immediately.

The maintenance of the Policy Bundle itself involves the App Protect Policy (that YAML object) and the sequenced workflow of ensuring that is on the shared volume of the NIC deployment prior to any change with the YAML object.
This is a workflow that is already documented. And this should align with that.

[github-actions]

✅ Deploy Preview will be available once build job completes!

Name	Link
😎 Deploy Preview	https://frontdoor-test-docs.nginx.com/previews/nginx-ingress-controller/5886/

---