feat(java): detect FormValidation handlers executing outbound HTTP without permission check (CWE-918)

[ai-anant]

New rule: codevigilant.java.jenkins.ssrf.formvalidation-httpclient-execute.

Detects Stapler form-validation / test-connection handlers (methods returning hudson.util.FormValidation, typically doCheck*/doTestConnection) that perform an outbound HTTP request via Apache HttpClient execute(...) without any permission check. Such handlers run on the Jenkins controller; when the request URL derives from stored credentials or configuration, an attacker can make the controller send credentialed requests to attacker-chosen hosts and observe reachability/status feedback (SSRF oracle, CWE-918, plus missing authorization CWE-862).

• Tree: java/jenkins/ssrf/
• Severity HIGH, confidence MEDIUM, CWE-918, validated with semgrep --validate (semgrep 1.172.0)
• Positive repro (fires): public FormValidation doTestConnection(...) { client.execute(req); return FormValidation.ok(); } with no permission check
• Negative repro (no fire): same method containing Jenkins.get().checkPermission(Jenkins.ADMINISTER); also no fire for execute() inside non-FormValidation methods