[dRafaleD]

Summary

• Adds 17 built-in rules: WMIC, msiexec and cmstp abuse, registry hive and ntds.dit credential access, browser Login Data, local admin add, service creation, firewall and UAC tampering, Office DDE, Unix cron/authorized_keys/ld.so.preload/history tampering, AWS metadata credentials.
• Each rule has a matching sample test; six benign strings added to the quiet-on-ordinary-text test.
• README rule count and CHANGELOG updated.

Test plan

• cargo test --lib builtin
• cargo fmt --all -- --check
• CI (clippy, full tests)