feat(content-manager): add non-mutating rules plan

[AAH20]

Summary

• add a read-only rules plan command that compares local rule content and deployment settings with Google SecOps
• emit deterministic JSON describing rule creation, revision, and state changes, with a canonical SHA-256 plan digest
• include remote revision identifiers for change-review evidence while excluding rule text and Google Cloud resource names
• document stdout and file-output workflows

Why

Rule updates currently move directly from local configuration to mutation APIs. Operators need a reviewable preview before changing production detections, especially in CI/CD and change-control workflows. This adds that preview without changing the existing update path.

The plan can be retained as machine-readable evidence, compared across runs, or reviewed before a separate update invocation.

Safety

The planner only loads local rules and reads remote rules. A regression test replaces the create, revision-update, and deployment-update functions and verifies that none are called.

Plan output deliberately omits rule source text and Google Cloud resource names.

Testing

• PYTHONPATH=tools/content_manager pytest -q tools/content_manager/content_manager
• 39 tests passed
• python -m py_compile tools/content_manager/content_manager/rules.py tools/content_manager/content_manager/__main__.py tools/content_manager/content_manager/test_rules.py
• python -m content_manager rules --help

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.