I've used Cloudflare rules, thanks. I've chosen to be a little more conservative:

    (any(http.request.headers["content-type"][*] contains "multipart"))

Note that Cloudflare rules are case-sensitive. I'm not sure whether PHP's parsing of "multipart" is or not, but you might consider:

  any(lower(http.request.headers["content-type"][*])[*] contains "multipart")

  if ($http_content_type ~* "multipart") { return 403; }