fix: reduce false positives and add global rule configuration

[satoridev01]

Summary

Introduces two new mechanisms for controlling rule behavior globally, then applies them to fix a class of false positives that surface when scanning mature Python codebases.

Problem

Scanning a large Django-based project produced 864 findings with -s HIGH. Manual verification showed that ~720 were false positives:

• 453 from PY515/SHELL645/SHELL670 — flagging every re.compile() call as "code compilation"
• 101 from PY102 — the taint engine firing on generic callable invocations
• 78 from PY511/JSON612 — json.loads() flagged as dangerous deserialization
• dozens more from AUTH711, CSRF747, SESS744, PATH813, etc. — firing on test fixtures and well-known safe patterns

Without filtering, scanning also revealed ~9,000 additional Low-severity findings from rules that flag every Python built-in (isinstance, super, len, f-strings, getattr, etc.).

Solution

1. [defaults] section in rules TOML

[defaults]
exclude_file_patterns = ["*tests*", "*fixtures*", "*testdata*", "*conftest*"]
disabled_rule_ids     = ["ISINSTANCE855", "LEN1101", "SUPER1128", ...]

• exclude_file_patterns — glob list applied to all rules; eliminates the need to repeat exclude_file_pattern on every individual rule
• disabled_rule_ids — completely disables noisy rules without deleting their definitions (easy to re-enable per project)

2. Per-rule exclude_pattern

Regex matched against the flagged line; suppresses the finding if it matches. Fixes rules that are correct in general but have well-known safe variants:

[[rule]]
id = "PY107"
ast_match = "Call(func.value.id=yaml, func.attr=load)"
# Safe when Loader=SafeLoader is explicitly passed
exclude_pattern = "Loader\\s*=\\s*(yaml\\.)?(Safe|Base)Loader"

Results on Django 6.1-alpha

	Before	After
Total findings (all severities)	864 (-s HIGH)	383
re.compile() false positives	453	0
yaml.load(SafeLoader) false positives	2	0
Test fixture credential false positives	9	0
Session fixation false positives	1	0
Python built-in noise rules	~9,000 (hidden by -s HIGH)	0
pickle.loads() true positives	57 → 8 (test files excluded)	✓ present
exec() true positives	3	✓ 3

Files changed

• src/pyspector/_rust_core/src/rules.rs — Defaults struct, Rule::is_file_excluded(), exclude_pattern field
• src/pyspector/_rust_core/src/analysis/mod.rs — apply disabled_rule_ids before scan
• src/pyspector/_rust_core/src/analysis/ast_analysis.rs — use is_file_excluded() and exclude_pattern
• src/pyspector/_rust_core/src/analysis/config_analysis.rs — same
• src/pyspector/rules/built-in-rules.toml — [defaults] section + per-rule fixes
• tests/unit/test_false_positive_reductions.py — 26 tests (each fix has a suppression test + true-positive retention test)

Test plan

• python -m pytest tests/unit/test_false_positive_reductions.py — 26 tests pass
• Scan a Django project: pyspector scan /path/to/django — confirm re.compile(), yaml.load(SafeLoader), and test-fixture findings are gone
• Confirm pickle.loads() and exec() findings still present in production code