RFC: Improvement: rules and how they interplay with clusters

Make it easy to define what clusters a rule should run in

Desired properties (very rough draft, open for comment):

1. "Write once, run anywhere" - meaning, write the rule once, have the option of it executing within any number of clusters vs. copy-pasta if you happen to break your rules out by cluster
2. Each rule shouldn't have to check the cluster it's operating within if you are already logically grouping rules into cluster specific files. Maybe have the option of defining the supported clusters atop the rules file?
3. Promote through process, or code, the idea of logically separating alert logic from the post-processing false-positive filtering logic. Why: this improves readability, it makes it easier to support (1) and (2), and it will make sharing rules with the public easier (e.g. no company, including ours, will be comfortable sharing the filtering logic since it's very environment specific)

This is a rough RFC and names no files, tests, or entry points to start from. First clarify the rule and cluster configuration model, then define how cluster targeting and the separation between alert logic and environment-specific filtering should work; done means the proposed behavior and scope are agreed.

Written by the indexing model from the issue text.