Add experimental crypto behavior taxonomy with contextual auth evidence

[n1ckl0sk0rtge]

Summary

Adds an experimental crypto behavior dimension to the CBOM output: each scan now derives what the analyzed application does cryptographically (encryptsData, signsData, validatesToken, …) from the CycloneDX 2.0-dev threat-modeling taxonomy (security:cryptography:*), emitted as a single namespaced property on bom.metadata.component:

• cbomkit:crypto:behavior = deduped, sorted, comma-joined behavior ids (experimental, non-standard; nothing is emitted when no behaviors are found)

What's included

Behavior derivation (output module) — a self-contained com.ibm.output.behavior subsystem:

• CryptoBehaviorMapper: per-asset, declarative operation/fallback mapping tables (operation-first, primitive-kind fallback)
• BehaviorCollector + BehaviorSignals + ordered IBehaviorRule registry (CryptoBehaviorRule, AuthInterfaceRule); new evidence families plug in via one signal field + one rule + one observe branch
• BehaviorMetadataWriter: the only CycloneDX-specific part (property formatting)
• Taxonomy snapshot crypto-behavior-taxonomy.json with an enum↔JSON sync test

Contextual auth evidence (engine + java modules) — application-level behaviors are gated on detected auth interfaces, so crypto alone never asserts them (a bare MAC no longer implies authenticates):

• New AuthContext detection context (JWT, OAUTH, SAML, PRINCIPAL, API_KEY, MTLS)
• AST detection rules for jjwt/Nimbus/Spring Security/OpenSAML/servlet-principal and friends (with test jars)
• ContextualEvidence mapper node carrying non-crypto signals through the node stream without polluting the crypto inventory
• Gating: authenticates ⟺ auth primary present; JWT/OAUTH/SAML also yield validatesToken; PRINCIPAL/MTLS also yield usesIdentity

Curated PRNG detection — SecureRandom detection incl. no-arg new SecureRandom() (note: this is broad by design and will emit a PRNG component + generatesRandomValue for most projects using it).

Design docs

Specs and task-by-task plans are under docs/superpowers/specs/ and docs/superpowers/plans/ (2026-07-03 … 2026-07-13).

Test plan

• Full multi-module mvn test green (output module 70/70, incl. CBOM regression anchor CryptoBehaviorMetadataTest)
• mvn checkstyle:check / mvn spotless:check clean
• Behavior unit coverage: mapper tables, auth gating rules, collector totality (unknown evidence identifiers, NONE kind, non-asset nodes)
• Detection tests per auth rule family; integration test proving auth signals never appear as CBOM components

Note: the branch contains one merge commit (db1dc94e, main back-merge) — squash-merge recommended given the "no merge commits" rule on main.

[san-zrl]

Hi @n1ckl0sk0rtge,

The build fails due to a failing test RuleMemoizationEnforcementTest.everyStaticRulesMethodIsMemoized. The CI log is blurred with lots of log messages like

11:09:13.386 [main] INFO com.ibm.engine.language.java.JavaDetectionEngine -- Detected constructor definition has more then one argument to resolve. Redefine the rule to explicitly define the param to resolve

so it's hard to find. Is this still work in progress or is it ready merging?

[INFO] Results:
[INFO]
[ERROR] Failures:
[ERROR]   RuleMemoizationEnforcementTest.everyStaticRulesMethodIsMemoized:119 [detection-rule classes whose static rules() is not memoized — wrap the body with Memoize.of(...) so shared subtrees are built once (see #476)]
Expecting empty but was: ["com.ibm.plugin.rules.detection.auth.PrincipalAuthRules",
    "com.ibm.plugin.rules.detection.auth.JwtAuthRules",
    "com.ibm.plugin.rules.detection.auth.MtlsAuthRules",
    "com.ibm.plugin.rules.detection.auth.AuthDetectionRules",
    "com.ibm.plugin.rules.detection.auth.SamlAuthRules",
    "com.ibm.plugin.rules.detection.auth.ApiKeyAuthRules",
    "com.ibm.plugin.rules.detection.auth.OAuthAuthRules"]
[INFO]
[ERROR] Tests run: 165, Failures: 1, Errors: 0, Skipped: 7
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for sonar-cryptography 2.0.0-SNAPSHOT:
[INFO]
[INFO] sonar-cryptography ................................. SUCCESS [  0.646 s]
[INFO] common ............................................. SUCCESS [  1.696 s]
[INFO] engine ............................................. SUCCESS [  5.281 s]
[INFO] mapper ............................................. SUCCESS [  6.105 s]
[INFO] output ............................................. SUCCESS [  1.609 s]
[INFO] enricher ........................................... SUCCESS [  0.999 s]
[INFO] rules .............................................. SUCCESS [  0.545 s]
[INFO] java ............................................... FAILURE [ 10.387 s]
[INFO] python ............................................. SKIPPED
[INFO] go ................................................. SKIPPED
[INFO] sonar-cryptography-plugin .......................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  27.490 s
[INFO] Finished at: 2026-07-20T11:09:14+02:00
[INFO] ------------------------------------------------------------------------