Note that Cloudflare rules are case-sensitive. I'm not sure whether PHP's parsing of "multipart" is or not, but you might consider:

  any(lower(http.request.headers["content-type"][*])[*] contains "multipart")

  if ($http_content_type ~* "multipart") { return 403; }