Introduce possibility to add git commit id as meta data for scans

[de-jcup]

Situation

When people get sechub

Wanted

As a developer using SecHub I want to know for which commit ID the report information was.

Solution

Inside a code scan we introduce a metaData container JSON with git container inside having field commit. This information is available in sechub report later as well.

SecHub Config changes

Example for SecHub config file (partial):

"codeScan" : {
     "metaData" : {
           "git" : {
                 "commit" : "aa893349"
           }
     }

}

• We only accept the metaData container with git and only commit id - all other values /containers inside metaData will be ignored. In future there could be more but always only dedicated, we DO NOT put all metaData through - reason: we avoid unvalidated user input... (persisted cross site scripting)
• We validate commit field to be only a valid git commit id

SecHub report changes

We need the information in report result - because input data is already validated and in a format suitable for report, I would suggest to simply add this to root node

Additional: We should add the report UUID also automatically inside the report JSON - if not already available inside there

Additional thoughts

We could later

• provide this automatically by SecHub go client (just check if git exe can be executed and get current commit id... by using git comand)
• use those information in our plugins to check that developer looks for same code base (commit Id) - if not we could recommend to switch or even provide possiblitiy to switch directly!

---
<sup>Albert Tregnaghi <albert.tregnaghi@daimler.com>, Daimler TSS GmbH, [imprint](https://github.com/Daimler/daimler-foss/blob/master/LEGAL_IMPRINT.md)</sup>

[Jeeppler]

The metadata block could be made more generic to support other version control systems as well. For example, Apache Subversion, Mercurial etc.

For git:

"codeScan" : {
     "metaData" : {
           "versionControl " : {
                "type" : "git",
                 "commit" : "aa893349"
           }
     }
}

For SVN:

"codeScan" : {
     "metaData" : {
           "versionControl " : {
                "type" : "svn",
                 "revision" : "4123"
           }
     }
}