[DOCS-XXXXX] Add IaC Security custom rules guide

[valeryjuli]

Motivation

IaC Security has a custom-rule authoring feature (Detection Coverage > IaC) with no existing documentation. This adds an overview page and a step-by-step tutorial covering the Rego rule contract (package datadog / DatadogPolicy contains result) used by both default and custom IaC rules.

Fixes DOCS-XXXXX (placeholder — replace with the real ticket before merging)

What's included

• content/en/security/code_security/iac_security/custom_rules/_index.md: rule contract, result fields, iteration pattern, testing guidance
• content/en/security/code_security/iac_security/custom_rules/tutorial.md: end-to-end tutorial (Terraform S3 versioning check)
• Nav entries in config/_default/menus/main.en.yaml
• Cross-links from iac_security/_index.md and iac_rules/_index.md

AI assistance disclosure

This content was drafted with Claude Code, grounded in verified Rego syntax/examples from the datadog-iac-scanner-default-rules repo and cross-checked against existing docs conventions (SAST custom rules pages, CSM custom rules pages). It has not yet been reviewed against the live Detection Coverage > IaC UI for exact button/field copy — see open items below.

Merge instructions

• Merge this PR myself once it's approved

Open items before merging

• Replace DOCS-XXXXX with a real ticket number (title + Fixes line)
• Verify exact UI copy/navigation in the live Detection Coverage > IaC custom-rule editor and align wording
• Confirm whether the custom-rule editor supports importing shared libraries (common_lib, etc.) — guide currently avoids claiming this
• Run yarn start locally to preview rendering and nav placement

Test plan

• vale passes on all new/edited files (0 errors)
• Menu YAML validated
• Local Hugo preview (not run — see open items)

[github-actions]

⚠️ Possible site support note detected

The following files have a site-region shortcode at the top of the page that mentions a feature being "not available" or "not supported":

• content/en/security/code_security/iac_security/iac_rules/_index.md

Are you trying to document site support for a product? If so, the site-region shortcode is not the recommended approach. See the Documenting site support guide for the preferred method.

[github-actions]

Preview links (active after the build_preview check completes)

New or renamed files

• https://docs-staging.datadoghq.com/valery.neira/iac-custom-rules-guide/security/code_security/iac_security/custom_rules/
• https://docs-staging.datadoghq.com/valery.neira/iac-custom-rules-guide/security/code_security/iac_security/custom_rules/tutorial

Modified Files

• https://docs-staging.datadoghq.com/valery.neira/iac-custom-rules-guide/security/code_security/iac_security/
• https://docs-staging.datadoghq.com/valery.neira/iac-custom-rules-guide/security/code_security/iac_security/iac_rules/