falco: tune out gitea SSH and firefly-iii wait-for-it.sh stdio redirects

"Redirect STDOUT/STDIN to Network Connection in Container" (a reverse-shell
detector) was firing legitimately: gitea's sshd/sshd-session dup2 the
accepted SSH socket onto stdio for every session (4x per connection), and
firefly-iii's wait-for-it.sh does the same TCP-readiness-check dance while
waiting for postgres. Both confirmed recurring via netdata's alert history,
not one-off. Scoped exceptions added to each's specific binary/cmdline,
not the whole container/image.

Verified: a gitea SSH login no longer alerts, while a real dup2-based
redirect (bash's /dev/tcp exec pattern) from an unrelated container still
fires - the exception is narrow, not a blanket disable.

"Run shell untrusted" was also flagged as noisy, but investigation showed
it fired exactly once, during my own rule-testing window, and never
before or since - left alone rather than building a permanent exception
for a self-caused test artifact.

falco/rules/tune-noise.yaml

@@ -49,3 +49,20 @@
     (container.image.repository = "docker.gitea.com/gitea" and proc.name = gitea)
     or (container.image.repository = "lscr.io/linuxserver/obsidian")
     or (container.image.repository = "tsl0922/ttyd" and proc.name in (telnet, pv, busybox-extras))
+
+# "Redirect STDOUT/STDIN to Network Connection in Container" false-positives,
+# both confirmed recurring (not one-off) via netdata's alert history:
+# - gitea: sshd/sshd-session redirect the just-accepted SSH connection's
+#   socket onto stdin/stdout/stderr via dup2 - this is simply how every SSH
+#   server handles every session, not a reverse shell. Fires 4x per SSH
+#   connection (sshd x2, sshd-session x2). Scoped to those two binaries in
+#   this one container, not the whole image, since gitea itself spawning
+#   this pattern from some other binary would still be worth flagging.
+# - fireflyiii/core: its wait-for-it.sh startup script opens a raw TCP
+#   connection to the postgres container to poll for DB readiness, which
+#   redirects stdio the same way a reverse shell would mechanically. Scoped
+#   to the script's own cmdline, not the whole image.
+- macro: user_known_stand_streams_redirect_activities
+  condition: >
+    (container.image.repository = "docker.gitea.com/gitea" and proc.name in (sshd, sshd-session))
+    or (container.image.repository = "fireflyiii/core" and proc.cmdline contains "wait-for-it.sh")