feat(plugins/rule-flood-guard): auto-disable flooding correlation rules and notify via bell

[yllada]

What

Adds a new standalone plugin (plugins/rule-flood-guard) that automatically disables correlation rules generating alert fatigue, and notifies the user through the notification bell.

When a rule produces more than 50 open, non-deduplicated, top-level alerts within a rolling 24-hour window, the guard:

1. Disables the rule via the existing enable/disable mechanism (no new UI, no new user-facing toggle).
2. Sends exactly one notification instructing the user to either mark the alerts as false positives (existing Alert Tag Rules feature) or fine-tune the rule (deduplicateBy/groupBy).

Why

Some correlation rules, when misconfigured or missing deduplicateBy/groupBy, flood the alerts list with individual, non-deduplicated alerts instead of grouping them. This causes alert fatigue: analysts stop paying attention to the alerts list and miss real signal. This is a safety net, not a fix for the root dedup-configuration problem (out of scope — see below).

[github-actions]

🛑 AI review — Engineer review required

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. @Kbayero @osmontero please review.

✅ architecture (gemini-3-flash-lite) — clean

Summary: Addition of rule-flood-guard plugin and routine dependency updates.

No findings.

✅ bugs (gemini-3-flash-lite) — clean

Summary: Dependency updates and addition of rule-flood-guard plugin; no critical bugs found.

No findings.

🛑 security (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Introduction of a new plugin 'rule-flood-guard' that interacts with internal APIs and performs automated rule deactivation.

• medium plugins/rule-flood-guard/backend.go:104 — The Deactivate function performs an automated state change (deactivating a correlation rule) based on data retrieved from OpenSearch. Ensure that the 'internalKey' used for authentication is sufficiently protected and that the backend API enforces strict authorization to prevent unauthorized rule manipulation.
• medium plugins/rule-flood-guard/backend.go:139 — The Notify function sends system-level notifications. Ensure that the 'internalKey' is not logged or exposed in error messages, as it is used for authentication against the backend API.

[utmstackprapprover]

Changes requested — Go dependencies check failed (see above).

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.