chore: bump SAST to 0.0.46

[jeremydubreil]

The --classes option SAST which was previously accepting a directory or a JAR file has now been replaced by a more generic --classpath option which is intended to be the standard Java classpath containing all the classes including the dependencies or self-contained JAR or WAR files with nested JAR dependencies.

The main goal is to make the SAST API more generic and able to work in the same way with Mariana Trench and Infer.

This changes the public API of the action code so we will need to create a different release tag to migrate the place where this code is used progressively.

[edoardopirovano]

Do we really need to make a new tag for just a renaming? Couldn't we temporarily accept both classes and classpath in the code while we update all usages to the latter?

[jeremydubreil]

@edoardopirovano
Yes, we can do this. I realized that I messed up my local commit and this PR should not pass the test because I forgot to update one of the files.

[edoardopirovano]

I think you need to thread through the new input here too:

code-security-action/action.yaml

Line 97 in 0c00505

with:

[jeremydubreil]

I think you need to thread through the new input here too:

code-security-action/action.yaml

Line 97 in 0c00505

with:

Should I pass both classes and classpath here?

[edoardopirovano]

Should I pass both classes and classpath here?

Yes please.

[jeremydubreil]

Actually, 1 is the expected number of SAST finding we need to detect on the test project. I don't know why were the tests passing before.