Expand every analytics rule domain to five examples

[leandroer]

Summary

• Add four new analytics rules to each of the seven detection domains.
• Expand the catalog from 7 to 35 rules, with five examples per domain.
• Document the additional AI, agent, and Purview schema assumptions.
• Refresh the README, coverage matrix, changelog, and generated rule catalog.

New coverage

• AI security: sensitive data disclosure, excessive token use, system prompt extraction, and content safety bypass.
• Agent 365: privilege escalation, data exfiltration, abnormal execution volume, and high-risk connectors.
• Identity: MFA fatigue, privileged role assignment, suspicious OAuth consent, and break-glass activity.
• Purview: mass downloads, sensitive external sharing, label downgrade, and external-sharing spikes.
• Cloud: Key Vault access spikes, diagnostic setting deletion, public storage, and NSG changes.
• Endpoint: Office-spawned shells, LOLBin downloads, credential dumping, and scheduled-task persistence.
• UEBA: new identity anomalies, service-account anomalies, unusual location/device activity, and anomalies preceding role assignment.

Validation

• python3 scripts/validate_rules.py — 35 rules validated.
• python3 scripts/generate_catalog.py --check — catalog current.
• git diff --check — clean.