feat(java): detect unescaped dataset-derived value embedded in chart tooltip/URL image-map generators (CWE-79)

[ai-anant]

Adds a rule for the Jenkins java/ tree:

codevigilant.java.jenkins.xss.chart-generator-unescaped-format

Detects the generic vulnerable shape:

class C implements CategoryToolTipGenerator {
    String generateToolTip(CategoryDataset ds, int s, int i) {
        String name = ds.getColumnKey(i).toString();   // non-literal, attacker-influenced display name
        return String.format(TMPL, name, ds.getValue(s, i));  // no HTML escaping
    }
}

A chart image-map tooltip/URL generator (CategoryToolTipGenerator / CategoryURLGenerator rendered by JFreeChart / hudson.util.Graph) passes a non-literal, dataset-derived row/build display name (getColumnKey / getRowKey / getDisplayName) into String.format() or string concatenation without HTML-escaping. The resulting string is emitted into an HTML image map (<map><area title=... href=...>) that Stapler injects into the served page. A crafted display name containing quotes or markup breaks out of the attribute and yields stored XSS (CWE-79).

• New tree java/jenkins/xss/
• Severity WARNING (taint mode; sources = getColumnKey/getRowKey/getDisplayName/toString, sinks = format/string-concat)
• Sanitizers for escapeHtml / StringEscapeUtils.escapeHtml / escaper.escapeHtml
• Validated with semgrep --validate --config java/
• Testcases: testcases/java/pos_chart_tooltip_xss.java (fires), testcases/java/neg_chart_tooltip_xss.java (silent)

No disclosure concerns: describes the code shape only.