ISOC 3689 add git hub code scanning webhook

[auzwang]

What's in this PR?
Adds Security in Jira code_scanning_alert webhook support. GitHub Security Code Scanning Alert webhooks will be transformed and submitted as Security Vulnerabilities in Jira.

Vulnerabilities are only submitted from the default or protected branch. This is done by checking

alert.most_recent_instance?.ref?.startsWith("refs/heads")

When a Code Scan Alert is found in a PR, then merged into the default or protected branch, a webhook with the action appeared_in_branch is triggered with the same alert number, which is subsequently submitted to Jira.

Remote Links will continue be handled in the same way.

Fixes an error where Code Scanning Alert Remote Link Webhook metrics were not being processed.

- context.payload.webhookReceived
+ context.webhookReceived

Why
Integrate GitHub with Security in Jira
https://hello.atlassian.net/wiki/spaces/CDX/pages/2673460294/RFC+GitHub+for+Jira+Security

Added feature flags
ENABLE_GITHUB_SECURITY_IN_JIRA

Affected issues
ISOC-3689

How has this been tested?
Locally
Unit Tests

Questions
We are emitting a new webhook metric for Code Scanning Alert Security Vulnerabilities (code_scanning_alert_security) in addition to the Remote Links handler. Does this make sense?

[gxueatlassian]

One small thing to double check, for

Vulnerabilities are only submitted from the default or protected branch. This is done by checking
alert.most_recent_instance?.ref?.startsWith("refs/heads")

I think refs/heads can also means any branches? We are accepting alerts from any branches, is that correct? But I could be wrong.

[auzwang]

One small thing to double check, for

Vulnerabilities are only submitted from the default or protected branch. This is done by checking
alert.most_recent_instance?.ref?.startsWith("refs/heads")

I think refs/heads can also means any branches? We are accepting alerts from any branches, is that correct? But I could be wrong.

Code scanning can be configured to trigger on push and pull requests to projected branches. So pushes to unprotected branches such as feature/abc-123 won't trigger code scan alerts until a PR is made targeting the default branch or a protected branch.

[mjordan-atlassian]

What's the difference between using this URL and https://cwe.mitre.org/data/definitions/${cweId} ?
The one you are using redirects to the data/definitions page anyway?

[auzwang]

I used the URL https://cwe.mitre.org/ uses in their ID Lookup input. The difference is the error page when supplying an invalid ID. I suspect there is future-proof credence using the cgi URL as it would be out in the wild and referenced in PDFs, hence the redirect.

Navigating using the definitions URL we get:

Whereas with the id param, we get: