owasp Cursor rules

2 tagged owasp, measured the same way as everything else here.