refactor(rules): group focused security rules

shared/rules/security/references/supply-chain.md

@@ -0,0 +1,6 @@
+# Supply-chain security
+
+* Keep dependencies minimal, maintained, and from verified sources; respect lockfiles and review identity and compatibility before adding or upgrading packages.
+* Pin versions where appropriate and remove unused dependencies.
+* Treat plugins, build scripts, CI actions, and generated artifacts as part of the attack surface.
+* Use least privilege for build and deployment identities and never expose credentials in pipelines, logs, or artifacts.