docs(rules): add false-positive taxonomy

[stacknil]

Summary

• add a shared false-positive taxonomy to the rule catalog
• document NAT, internal scanner, lab replay, shared bastion, scheduled admin task, and malformed log replay for each rule
• link the case-study false-positive boundary back to the rule catalog taxonomy

Validation

• git diff --check
• taxonomy bucket grep across rule catalog
• ctest --test-dir build -C Debug --output-on-failure