feat(detection): language-scoped rules + multi-language benchmark corpora

Rebuild the quick-scan detection engine and ground-truth benchmarks to hit
>=90% recall / <10% false positives for C/C++, Python, JavaScript, and Java.

Engine (findings.py, preprocess.py):
- Scope each PatternRule by language (fixes cross-language false positives such
  as the Python eval/exec rule firing on JS .exec()).
- Add JavaScript/TypeScript rules (command exec, eval/Function, reflected XSS,
  SQLi, path traversal, SSRF, weak hash, deserialization); execFile/spawn-argv
  excluded as safe alternatives.
- Add Java rules (Runtime exec, SQL string concatenation, weak hash, readObject)
  and a Groovy server-side template rule (yieldUnescaped of a bound variable).
- Broaden C/C++ and Python coverage; precision guards for format strings and
  parameterised vs concatenated SQL; #-comment skipping; CWE in rationale.
- Register .java/.groovy/.tpl source extensions.

Benchmarks:
- Add realistic corpora modeled on Damn Vulnerable C/C++, PyGoat/DVPWA, and
  NodeGoat, plus the real kiview/damn-vulnerable-spring-boot-app vendored
  verbatim (MIT, attribution in LICENSE/NOTICE.md). Each manifest carries
  complete, independently-labeled ground truth including genuinely
  hard-to-detect vulns (integer overflow, second-order SQLi, prototype
  pollution) so recall is measured honestly, plus safe-API files for precision.
- Fix pre-existing smoke-manifest ground-truth errors (Python/JS line offsets,
  missing C/C++ strcpy entry, Java SQLi line).

benchmark.py:
- Fix sink matching to normalise the expected sink consistently so sinks with
  underscores (e.g. render_template_string) can match.

Tests:
- Add tests/test_detection_benchmarks.py enforcing the >=90% recall / <10% FP
  goal per language and overall.

Measured: C/C++ 93.3%, Python 93.3%, JavaScript 92.3%, Java 100%;
overall 93.6% recall, 0.0% false-positive rate.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

benchmarks/manifests/python-vulnerable.toml

@@ -0,0 +1,127 @@
+name = "python-vulnerable"
+language = "python_web"
+frameworks = ["flask"]
+setup = ["pip install flask pyyaml requests"]
+modes = ["quick", "standard"]
+known_noise = []
+baselines = []
+
+[source]
+type = "local"
+path = "../fixtures/python-vulnerable"
+
+[[expected]]
+cwe = "CWE-78"
+class = "command injection"
+path = "app.py"
+line = 17
+rule_id = "python-os-command"
+sink = "os.system"
+evidence = "os.system runs an attacker-controlled command"
+
+[[expected]]
+cwe = "CWE-78"
+class = "command injection"
+path = "app.py"
+line = 23
+rule_id = "python-shell-true"
+sink = "subprocess"
+evidence = "subprocess runs an attacker-controlled command with shell=True"
+
+[[expected]]
+cwe = "CWE-95"
+class = "code injection"
+path = "app.py"
+line = 28
+rule_id = "python-unsafe-eval"
+sink = "eval"
+evidence = "eval executes attacker-controlled input"
+
+[[expected]]
+cwe = "CWE-502"
+class = "insecure deserialization"
+path = "app.py"
+line = 33
+rule_id = "python-unsafe-deserialization"
+sink = "pickle.loads"
+evidence = "pickle.loads deserializes the request body"
+
+[[expected]]
+cwe = "CWE-502"
+class = "insecure deserialization"
+path = "app.py"
+line = 38
+rule_id = "python-unsafe-deserialization"
+sink = "yaml.load"
+evidence = "yaml.load deserializes untrusted input"
+
+[[expected]]
+cwe = "CWE-89"
+class = "sql injection"
+path = "app.py"
+line = 44
+rule_id = "python-sql-injection"
+sink = "execute"
+evidence = "execute concatenates request input into the SQL query"
+
+[[expected]]
+cwe = "CWE-89"
+class = "sql injection"
+path = "app.py"
+line = 50
+rule_id = "python-sql-injection"
+sink = "execute"
+evidence = "execute uses percent formatted request input in SQL"
+
+[[expected]]
+cwe = "CWE-22"
+class = "path traversal"
+path = "app.py"
+line = 55
+rule_id = "python-path-traversal"
+sink = "open"
+evidence = "open reads an attacker-controlled file path"
+
+[[expected]]
+cwe = "CWE-918"
+class = "server-side request forgery"
+path = "app.py"
+line = 60
+rule_id = "python-ssrf"
+sink = "requests.get"
+evidence = "requests.get fetches an attacker-controlled url"
+
+[[expected]]
+cwe = "CWE-327"
+class = "weak cryptography"
+path = "app.py"
+line = 65
+rule_id = "python-weak-hash"
+sink = "md5"
+evidence = "hashlib.md5 is a weak hash"
+
+[[expected]]
+cwe = "CWE-94"
+class = "server-side template injection"
+path = "app.py"
+line = 70
+rule_id = "python-ssti"
+sink = "render_template_string"
+evidence = "render_template_string evaluates attacker-controlled input"
+
+[[expected]]
+cwe = "CWE-89"
+class = "sql injection"
+path = "app.py"
+line = 77
+sink = "execute"
+evidence = "execute runs a SQL query string built from request input on a prior line"
+
+[[expected]]
+cwe = "CWE-489"
+class = "insecure default"
+path = "app.py"
+line = 81
+rule_id = "python-flask-debug"
+sink = "debug"
+evidence = "flask debug mode is enabled in production"