Securing Mobile Backends: How to Configure Cloud API Gateways Against App Decompilation and Reverse Engineering