fix: Record GetFilters API duration and upgrade GAF to v0.16.1

[danskmt]

What does this PR do?

Adds two analytics values that make the GAF file-filter timings interpretable, and upgrades go-application-framework to v0.16.1.

GetFilters is fetched lazily on the first file that passes the file filter. Because GetFilteredFiles hands back an unbuffered channel, the filter goroutine is blocked on send while the consumer makes that request — so the network time lands inside GAF's file-filter.filter.durationMs. That is why durationMs tracks upload_duration_ms closely and cannot be read as filtering cost.

New values:

• get_filters_ms — accumulated time spent in GetFilters, including failed requests
• get_filters_calls — number of GetFilters requests; expected to be 1 per scan

This lets the network cost be subtracted in Datadog:

GAF file-filter durationMs - get_filters_ms = filtering + non-network work

Both values are recorded inside SupportedFilesFilter, so they apply to every consumer of the filter (CLI and snyk-ls) and to both upload paths (files-bundle-store via bundleManager, file-upload-api via uploadRevision) without changes at either drain site.

Accumulation is held in atomic.Int64 counters and the running total is republished on each call. AddExtensionIntegerValue overwrites its key and the analytics payload is POSTed once at the end of the command, so the final write is the total. GAF's metrics.Recorder exposes only the three AddExtension*Value methods, so no AddToSum is reachable from this module.

Where should the reviewer start?

• internal/util/supportedfiles/filter.go — the accumulator, the metric names, and the timing around GetFilters
• bundle/bundle_manager.go and internal/uploadrevision/upload_revision.go — pass the analytics client into NewSupportedFilesFilter
• go.mod / go.sum — GAF v0.11.0 to v0.16.1

How should this be manually tested?

1. Build the CLI against this branch.
2. Run snyk code test --debug on a repository with a .gitignore and a populated node_modules.
3. In the analytics.report payload at the end of the run, confirm get_filters_ms is present and get_filters_calls is 1.
4. Confirm file-filter.filter.durationMs - get_filters_ms no longer tracks upload_duration_ms.

What's the product update that needs to be communicated to CLI users?

None. Analytics only, with no change to scan behaviour or results.

Checklist

• Tests added and all succeed
• Linted
• README.md updated, if user-facing

🚨After having merged, please update the snyk-ls and CLI go.mod to pull in latest client.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 22 relevant code sections from 14 files (average relevance: 0.95) internal/deepcode/mocks/client.go (lines 1-84) internal/commands/code_workflow/native_workflow.go (2 segments, lines 1-200) scan.go (lines 250-488) internal/deepcode/client.go (lines 1-269) internal/analysis/analysis.go (lines 1-239) bundle/mocks/bundle_manager.go (lines 1-83) bundle/bundle.go (lines 1-184) ... and 7 more file(s)

🤖 Repository instructions applied (from AGENTS.md)