refactor(rules): group focused security rules

shared/rules/security/references/web.md

@@ -0,0 +1,7 @@
+# Web and frontend security
+
+* Escape or sanitize untrusted content; never inject untrusted HTML or bypass framework sanitization.
+* Protect state-changing browser requests from CSRF where applicable.
+* Use `HttpOnly`, `Secure`, and appropriate `SameSite` cookie settings for sensitive sessions.
+* Validate redirect targets, avoid sensitive data in URLs, and use CSP and clickjacking protections where applicable.
+* Treat frontend code and browser storage as visible and never rely on client-side checks for authorization.