Add a .zap/rules.tsv example so the ZAP scan can be tuned

[iampopye]

The gap

examples/zap-baseline-scan.yml passes rules_file_name: ".zap/rules.tsv", but that file does not exist anywhere in this repo. Anyone copying the example has no idea what the file should contain.

Why it matters

A baseline ZAP scan reports findings that are often already accepted risks for a given app (a missing header on an internal-only endpoint, for example). Without a rules file, every run fails on the same known findings, and people respond by deleting the scan entirely. A rules file is how you say "we know, and we have decided" without turning the check off.

What to do

1. Create examples/.zap/rules.tsv
2. Add 3-5 commented example rows showing the format: rule ID, action (IGNORE / WARN / FAIL), and a URL regex
3. Add a comment block at the top explaining where to find rule IDs in the ZAP report
4. Mention it in examples/README.md

Format reference

Tab-separated: <rule-id>\t<action>\t<url-regex>. See the ZAP action docs.

How to check your work

There is nothing to run here — it is a documentation file. Just make sure the tabs are real tabs, not spaces, because ZAP will not parse spaces.

New to this? Say so in a comment and you will get help.