[rennf93]

Closes #136

Four commits, one per point, each ported from the merged Python reference (Guard-Core/guard-core #162 and #165, and the semantic header exclusion) and cross-checked against the Go port.

• fix(logging): a passive-mode suspicious line without trigger info now reads [PASSIVE MODE] Suspicious activity detected from ... - Reason: ... - Headers: ..., and the rate-limit stage passes its real passive_mode to the log instead of a hardcoded false.
• docs(config): the enable_dynamic_rules field doc lists exactly what a rule changes.
• feat(detection): opt-in excluded_semantic_detection_headers (default empty) on SecurityConfig, RouteConfig, DetectionExclusionConfig and RouteDetectionExclusions, plus a semantic_headers argument on the detection_exclusion decorator. Listed headers skip only the semantic analyzer (detect_with_semantic_skip), the regex scan is unchanged, names are trimmed and matched case-insensitively, and the route set merges with the global set.
• fix(detection): the Cookie header is scanned one name=value pair at a time. Pairs split on ;, only spaces are trimmed so CR/LF stay in the value, empty pairs are skipped, each pair counts against the value budget, and the semantic opt-out applies per pair.

ResolvedExclusions, DetectionExclusionConfig, RouteDetectionExclusions, RouteConfig and SecurityConfig gain a public field, and SecurityDecorator::detection_exclusion gains a trailing argument, so struct literals and callers of those need updating on the next release.

The conformance gates are unchanged and green. The corpus is untouched.