[Good First Issue] Add Falco alert ingestion adapter

[Jaycubic]

Add a Falco alert adapter that validates incoming events, preserves Falco-specific fields, maps them to canonical security events, and adds test fixtures for representative syscall/runtime alerts.