Allow pulling rules from non-local sources

Either via just plain old HTTP(S) file queries or possibly via ORAS with something like https://github.com/opcr-io/policy - or possibly we could support both.

The advantage of this would be that we could define a set of common requirements for:
- Security
- best practices for running on AKS
- etc

and then reuse them in different contexts. Main wins of reuse are for other projects like extensions that might run a subset of AKS linters but benefit from updates to the core security linters (rather than duplicate)