Card: Create semgrep rules

The initial set of rules do not have to be perfect, it is okay for them to have false positives or false negatives. We are learning to create rules as we go.