feat(java): detect unescaped concatenated string built into request/execution JSON payload (CWE-94)

[ai-anant]

Detects a Java/Jenkins pattern where a request/execution parameters value is constructed by raw '+' string concatenation that includes at least one non-literal (config-/user-/macro-derived) operand, then passed to an API parameters/JSON/content sink such as setParameters, setJson, or setCommandContent. When the non-literal operand is not escaped, a value containing JSON or command metacharacters (e.g. a double-quote) breaks out of the surrounding string and injects or corrupts the payload.

• Rule id: codevigilant.java.jenkins.injection.json-payload-unescaped-concat
• Severity: ERROR, mode: taint (source = '+' concat with a non-literal operand; sink = setParameters/setJson/setCommandContent)
• CWE-94 (code injection) / OWASP A03:2021 Injection
• Validated with semgrep --validate; fires on a positive repro (raw concat of variables into a JSON payload passed to setParameters) and does not fire on negatives (pre-built literal payload, or concatenation of two string literals).
• New java/jenkins/injection tree (added alongside existing java/jenkins/xxx rules).

[ai-anant]

Closing this lower PR in the stacked branch series: its rule content is fully contained in the newer see PR #156 (superset), which is a strict superset. Merging the newer PR delivers all rules once; keeping this separate PR would double-ship them.