Fill out half of remaining ruletypes in policy for level 1

[evankanderson]

We completed VM-05 but didn't link it in. This adds BR-03 and AC-02 (handled trivially by GitHub) as well. Still missing:

• AC-01: this needs the organization object (and possibly GitHub App permission changes)
• BR-09: this needs writing, it depends on the release object (some testing needed)
• LE-04: I think this is in progress, so I didn't do it.

From discussion on https://github.com/ossf/security-baseline/pulls, it looks like there will be the following changes:

• Move BR-10 up one level: Increase maturity level for BR-10 ossf/security-baseline#162

• Add DO-03 (Add check for OSPS-DO-03: repo contains end-user documentation #232) and DO-05 (I will have a PR shortly) to level 1

  Move DO-13 and SA-02 to level 2.

  Increase maturity level for BR-10 ossf/security-baseline#162

• Rewriting QA-03 to target having a per-language-ecosystem lockfile and moving it to level 1: Add dependency/SBOM criteria and releveling ossf/security-baseline#163