feat: report semgrep findings as a CWE/OWASP table; honour nosemgrep

[arootroatch]

Requested: map findings to their CWE / OWASP Top 10 classes instead of just
printing a location. semgrep already carries all of it in
tool.driver.rules[].properties.tags.

#  SEVERITY  FILE:LINE                                      RULE               CWE               OWASP     CONFIDENCE
1  warning   src/clj/cleancoders/db_browser/engine.clj:58   cc-generic-catch   CWE-396, CWE-636  A10:2025  LOW
2  warning   src/clj/cleancoders/db_browser/engine.clj:165  cc-generic-catch   CWE-396, CWE-636  A10:2025  LOW
3  warning   src/clj/cleancoders/mfa.clj:218                cc-generic-catch   CWE-396, CWE-636  A10:2025  LOW
4  warning   src/clj/cleancoders/web.clj:31                 cc-generic-catch   CWE-396, CWE-636  A10:2025  LOW
5  error     src/cljs/cleancoders/contact.cljs:224          cc-cljs-innerhtml  CWE-79            A05:2025  HIGH

CWE:
  CWE-396: Declaration of Catch for Generic Exception
  CWE-636: Not Failing Securely ('Failing Open')
  CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
OWASP:
  A05:2025 - Injection
  A10:2025 - Mishandling of Exceptional Conditions

semgrep: 5 finding(s), 1 blocking (error-level)
         2 additional finding(s) suppressed in source (nosemgrep)

Identifiers stay in the table and the legend expands each once — inlining the
full CWE titles pushed rows past 200 columns.

It found a real bug: nosemgrep was being ignored

Building the fixture from cleancoders.com's actual scan turned up that both
secret findings carry suppressions: [{"kind": "inSource"}] — the source has
nosemgrep annotations and semgrep honoured them, but still emits the
result. The reporting counted them anyway.

So those two already-triaged findings were being reported and blocking the
build, which makes nosemgrep look broken. Suppressed results are now excluded
from the table, the legend and the exit code, and reported as a count so the
suppression stays visible rather than silent.

cleancoders.com's real number is 1 blocking, not 3. The only genuinely
actionable finding is cc-cljs-innerhtml at contact.cljs:224.

Structure

Rendering and the exit decision move into bin/report-sarif.sh, called via the
checkout the semgrep job already does. 37 lines of inline jq in YAML become 7.
bin/test-report-sarif.sh covers it with 20 cases against a real captured SARIF,
pinning: suppressed excluded, warnings never block, error-level blocks, clean
scan passes, missing SARIF fails loudly.

The fixture has region.snippet stripped. semgrep embeds the matched source
line, which for a secret-detection rule is the secret itself — and this repo is
public.

🤖 Generated with Claude Code