Add CodeRabbit org config for the coreruleset organization

The org holds two kinds of repository — the rule set (seclang .conf,
regex-assembly .ra, go-ftw YAML) and its Go and Python tooling — so the
config is built around path-scoped guidance that keeps each from being
reviewed as the other.

Nine path_instructions carry the domain knowledge a generic reviewer
lacks: rule ID ranges and metadata, anomaly scoring, paranoia-level
consistency, .ra syntax gotchas, go-ftw test structure, plus Go and
Python conventions. Thirteen pre-merge checks cover what no single line
can express, including regex-assembly source-of-truth, test coverage for
rule changes, ReDoS and RE2 compatibility, existing-coverage proof for
new detections, and AI contribution disclosure.

Labels follow the release: changelog taxonomy consumed by
.github/release.yml, one per PR via mutually_exclusive_groups.

Validation runs yamllint and check-jsonschema on every PR and weekly,
since the schema is fetched at run time.

Author: fzipi