add config/firebase-security-rules.json, skeleton rules for this toy project