Support custom/org-specific rule packs (rules as data, not hardcoded)

[mesrikanthreddy]

Why

The detection rules (backend/app/engine/ast_rules.py, entropy.py) are currently hardcoded in the engine. Teams adopting KShield at an org level will have internal patterns to catch (e.g. company-specific auth helper misuse, internal secret formats) that generic rules can't cover. Letting rules be defined as data rather than code is what turns KShield from a fixed linter into a platform teams can extend.

Proposed scope

• Extend .kshield.yml (already referenced by VS Code extension doesn't read .kshield.yml suppression config #28 for suppression config) to also support custom rule definitions: pattern/AST-shape, severity, message, ELI5 remediation text.
• Engine loads custom rules alongside built-ins at scan time and merges results the same way suppression is merged today (see apply_suppressions in backend/app/engine/suppress.py).
• Needs a decision on rule format: regex/entropy-style rules are straightforward; AST-shape custom rules are harder and may need a constrained DSL rather than raw Python for safety (untrusted rule files shouldn't execute arbitrary code).

Dependencies

• Should land after or alongside VS Code extension doesn't read .kshield.yml suppression config #28 (VS Code extension reading .kshield.yml) so both consumers of the config format ship together.