Port the reference fixes: passive log reason, semantic header opt-out, Cookie pair scan, dynamic rules docs #87

The Python reference engine fixed four things that the Go port still lacks:

• A passive-mode suspicious log without a trigger (a rate-limit hit) is labelled a penetration attempt and drops the reason (fix(logging): keep the reason on passive suspicious logs and document dynamic rules guard-core#165).
• There is no way to keep a header whose value scores near the semantic threshold (a JWT session cookie) out of the semantic analyzer while the regex scan keeps covering it. I am adding an opt-in ExcludedSemanticDetectionHeaders (default empty), global and per route, which skips only the semantic analyzer.
• The Cookie header is scanned as one value, so the semicolons between cookies count as command separators in the semantic score and an ordinary logged-in header reaches 0.711 against the 0.7 threshold ([BUG] Normal logged-in Cookie headers are rejected as "Semantic attack: suspicious (score: 0.71)" guard-core#161, fixed by #162).
• EnableDynamicRules does not document what a rule can change, and the configuration page still lists dynamic rules as unsupported.