new(docs): add rule selection documentation

[LucaGuerra]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind content

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area documentation

What this PR does / why we need it:

Document this: https://github.com/falcosecurity/falco/pull/3178

Which issue(s) this PR fixes:

Fixes #1316

Special notes for your reviewer:

[LucaGuerra]

/hold

until 0.38.0 release

[incertum]

Nice!

If we accept the patch that prints all enabled rules when running Falco with -o log_level=debug similar to how we print the final set of syscalls please add that to the docs.

In addition, would say it's worth another announcement update in the rules repo readme https://github.com/falcosecurity/rules.

[LucaGuerra]

/milestone falco-0.38.0

[LucaGuerra]

/assign

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: leogr, LucaGuerra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[content/OWNERS](https://github.com/falcosecurity/falco-website/blob/master/content/OWNERS)~~ [LucaGuerra,leogr] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

[poiana]

LGTM label has been added.

Git tree hash: 57daf23613e93a5a3c072b11a1b1b485ab6647f3

[LucaGuerra]

/unhold