What is the Access Control policy in Apigee and how do you allowlist/denylist IPs?

<!-- Allow only specific IP ranges (allowlist) -->
<AccessControl name="AC.AllowInternalOnly">
  <IPRules noRuleMatchAction="DENY">  <!-- DENY if no rule matches -->
    <MatchRule action="ALLOW">
      <SourceAddress mask="24">10.100.0.0</SourceAddress>  <!-- /24 subnet -->
    </MatchRule>
    <MatchRule action="ALLOW">
      <SourceAddress mask="32">203.0.113.50</SourceAddress>  <!-- single IP -->
    </MatchRule>
  </IPRules>
</AccessControl>

<!-- Denylist specific IPs (block known bad actors) -->
<AccessControl name="AC.DenyBadActors">
  <IPRules noRuleMatchAction="ALLOW">  <!-- ALLOW if no rule matches -->
    <MatchRule action="DENY">
      <SourceAddress mask="32">192.0.2.100</SourceAddress>
    </MatchRule>
  </IPRules>
</AccessControl>

<!-- IMPORTANT: In environments with a load balancer,
     the client IP may be in X-Forwarded-For, not the direct connection.
     The ValidateBasedOn element handles this:
-->
<AccessControl name="AC.XFF">
  <ValidateBasedOn>X_FORWARDED_FOR_ALL</ValidateBasedOn>
  <IPRules noRuleMatchAction="DENY">
    <MatchRule action="ALLOW">
      <SourceAddress mask="24">10.0.0.0</SourceAddress>
    </MatchRule>
  </IPRules>
</AccessControl>