Tune Falco's default ruleset to reduce false positives using rule overrides, exceptions, and custom macros instead of editing shipped rules directly

Steps

1. Leave the vendor-shipped falco_rules.yaml untouched, and add customizations in a separate file loaded afterward via the rules_files list in falco.yaml (Falco loads default rules, then any files under /etc/falco/rules.d).
2. Use an override block for an existing rule (append or replace semantics) to modify its condition, output, or exceptions without rewriting the rule from scratch.
3. Add granular exceptions entries to a rule (e.g., allow-listing a known process or container image) so legitimate activity doesn't require broadening the rule's core condition.
4. Extract repeated logic into reusable macros and lists and reference them from multiple rules for maintainability.
5. Track alert volume and false-positive/negative rate after each change, iterating in small increments rather than disabling entire rule categories outright.