feat(java): detect CanonicalIdResolver subclasses resolving identities without an authorization check (CWE-290)

[ai-anant]

Rule: CanonicalIdResolver subclass without authorization check (CWE-290)

Adds a Java rule detecting hudson.model.User.CanonicalIdResolver subclasses whose
resolveCanonicalId implementation performs no permission check.

Generic vulnerable shape

@Extension
public class SomeIdentityResolver extends User.CanonicalIdResolver {
    @Override
    public String resolveCanonicalId(String id, Map<String, ?> context) {
        // maps caller-supplied identifiers to canonical user IDs from
        // self-service, unverified data — no checkPermission/hasPermission
        for (User user : User.getAll()) {
            if (user.getProperty(SomeIdentities.class).matches(id)) {
                return user.getId();
            }
        }
        return null;
    }
}

Why it matters

User.CanonicalIdResolver is a global extension point consulted by User.get(...)
whenever an ID or full name is resolved, including authentication flows and SCM
committer mapping. When the mapping is derived from unverified, user-editable data,
an attacker can claim another user's identifier and redirect every name→user
resolution for it (attribution spoofing, notification/approval redirection, login
binding confusion). Resolvers must verify identity ownership or require an
authorization check before returning a canonical ID.

Rule

• id: codevigilant.java.jenkins.identityresolution.missing-authorization
• severity: HIGH
• validation: semgrep --validate --config java/ passes
• positive repro fires, sanitized (permission-checked) repro does not fire