feat: import Snyk Open Source SARIF findings

[mldangelo-oai]

Summary

Adds Snyk Open Source SARIF imports to the existing findings publisher. Users can preview vulnerability findings, confirm publication, and replay updated reports with stable identities while keeping source claims separate from Cloud assessments. Stacked on #1632.

Changes

Retains each selected rule, result, and document context as original evidence. Identity uses the advisory and manifest set within a stable organization/project/branch source key. Source severity and dependency paths survive normalization without invented fixes or source lines.

New uploads check retained repository claims against the selected Cloud repository. Saved requests remain bound to their original repository ID, including after a repository rename. Unsupported products, license findings, unresolved indexed/base-relative artifacts, inconsistent references, malformed UTF-8, and ambiguous duplicate identities are rejected or explicitly excluded.

Testing

• 289 focused tests across the adapter and publication suites passed, including parent adapters, 500-record input, gzip, repository binding, retries, malformed input, and duplicate cases.
• Types, generated contracts, formatting, builds, pinned Python checks, and nine portable checks passed.
• Official public Snyk fixtures passed nine check groups: one supported report and six explicitly rejected profiles.
• Exact-head package validation passed (642 entries), including the installed-package smoke checks.
• Both full-suite orders ran (seeds 12345 and 503277258): each had 5,183 passes, 75 skips, and one installed-hook test failure also reproduced on unchanged main. Hooks remained enabled.
• Three fresh native review passes and a separate independent verifier found no remaining actionable issues at a54b1e85.

Hosted CI must qualify this updated head. Live Snyk tenant and Cloud upload/readback verification remain pending.

Risk and rollout

Requires the parent publisher and compatible Cloud import support. Preserve the same source key across exports and inspect exclusions before publishing. This does not run validation scans, fetch report URLs, or enable deployment gates.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.