WAF JS Challenge Resource Test v8

Upload/extract so it creates TWO root-level folders:
waf-test/
json-test/

Main UI:
- /waf-test/index.php

Target resources:
- /json-test/index.html
- /json-test/app.js
- /json-test/api-test.json
- /json-test/data.json

Keep /waf-test/* outside the challenge rule.
Apply Require JavaScript Support broadly to URL starts with /json-test/ to prove non-HTML resources can be challenged.
Then refine the rule to HTML resources only and confirm JS/JSON are not challenged.
