feat(java): detect CredentialsStore authorizing via global ACL or forced SYSTEM auth (CWE-862)

[ai-anant]

New generic Jenkins security rule.

Pattern (generic):
A CredentialsStore subclass (extends CredentialsStore) that either

• checks Jenkins.getInstance().getACL().hasPermission(...) / Jenkins.getInstance().hasPermission(...) instead of the owning ItemGroup/folder ACL, and/or
• fetches credential data by passing a hardcoded ACL.SYSTEM authentication into a getCredentials*/data-retrieval call.

Why it matters: the store's authorization surface is then enforced against the top-level Jenkins ACL only, independent of the item/folder the store was created for, and the data path is force-satisfied with SYSTEM privileges even when the caller holds only the checked global permission. A principal holding that global permission can enumerate/obtain credential objects belonging to another item scope, bypassing folder and per-credential authorization (CWE-862).

Fix guidance: consult the owner ACL (((ACLContext) getContext()).getACL()) and pass the caller's Authentication, never ACL.SYSTEM, on retrieval paths.

Validated with semgrep --validate; fires on a vulnerable-store repro and does not fire on a sanitized owner-ACL/store repro.

[ai-anant]

Closing this lower PR in the stacked branch series: its rule content is fully contained in the newer see PR #143 (superset), which is a strict superset. Merging the newer PR delivers all rules once; keeping this separate PR would double-ship them.