[WAF] Clarify content scanning size limit and document truncated field

[gyx-cf]

Summary

Corrects the documented behaviour of the 50 MB content scanning size limit on the
malicious uploads page, and documents the cf.waf.content_scan.truncated field.

The page currently states that all content objects in a request will be checked, and
that objects over 50 MB are partially scanned. That is accurate for a request carrying
a single content object, but not for multipart requests with several files. The 50 MB
budget applies to the request body as a whole, so in a multipart request the objects
share it. Once the limit is reached, the object that extends past it is not
scanned, and neither is any object that follows.

This matters because the omission is silent. Skipped objects are not counted in
cf.waf.content_scan.num_obj, do not appear in cf.waf.content_scan.obj_results, and
do not set cf.waf.content_scan.has_failed. A partly scanned request can therefore
produce the same field values as a request that was fully scanned and found clean.

cf.waf.content_scan.truncated is how customers should detect this case.

Testing

Built locally with pnpm run build (9006 pages, no errors) and confirmed:

• the generated field reference page renders at the expected path
• the #size-limit anchor resolves
• the existing #scanned-content anchor is unchanged

pnpm run format:check passes.