[Good First Issue] Add Falco telemetry examples

[Jaycubic]

Document representative Falco alert fixtures and show how source-specific fields map into canonical security events. Add validation tests.