feat(policies): add risk severity via data category

[elsapet]

Description

• Update RiskDatatype type to include data type category
• Update logger_leaks policy to output locations with severity
• Update Policy type to include Name and Description, and pass these to rego policies
• Add data categories to DB and use these in policies.GetOutput

New logger policy output

=> go run cmd/curio/main.go scan ~/test --report=policies
=> [
  {
    "result": [
      {
        "data_type": "Physical Address",
        "filename": "temp.rb",
        "line_number": 1,
        "policy_description": "Logger leaks detected",
        "policy_id": "detect_ruby_logger",
        "policy_name": "Logger leaks",
        "severity": "high"
      },
      {
        "data_type": "Unique Identifier",
        "filename": "temp.rb",
        "line_number": 1,
        "policy_description": "Logger leaks detected",
        "policy_id": "detect_ruby_logger",
        "policy_name": "Logger leaks",
        "severity": "critical"
      }
    ]
  }
]

Checklist

• I've added test coverage that shows my fix or feature works as expected.
• I've updated or added documentation if required.
• I've included usage information in the description if CLI behavior was updated or added.
• PR title follows Conventional Commits format

[swarmia]

✅  Linked to AMA-3204 · Add data category (severity) to the policy
➡️  Part of AMA-3203 · Policies: OPA Implementation
➡️  Part of AMA-2947 · OSS - Curio CLI

[vjerci]

looks good to me

[cfabianski]

What do you think about getting this output instead?

 [
   {
      "data_type": "Physical Address",
      "filename": "temp.rb",
      "line_number": 1,
      "severity": "high",
      "policy_description": "Logger leaks detected",
      "policy_id": "detect_ruby_logger",
      "policy_name": "Logger leaks"
    },
    {
      "data_type": "Unique Identifier",
      "filename": "temp.rb",
      "line_number": 1,
      "severity": "critical",
      "policy_description": "Logger leaks detected",
      "policy_id": "detect_ruby_logger",
      "policy_name": "Logger leaks"
    }
]

[elsapet]

@cfabianski I can get something like this:

[
  {
    "result": [
      {
        "data_type": "Physical Address",
        "filename": "temp.rb",
        "line_number": 1,
        "policy_description": "Logger leaks detected",
        "policy_id": "detect_ruby_logger",
        "policy_name": "Logger leaks",
        "severity": "high"
      },
      {
        "data_type": "Unique Identifier",
        "filename": "temp.rb",
        "line_number": 1,
        "policy_description": "Logger leaks detected",
        "policy_id": "detect_ruby_logger",
        "policy_name": "Logger leaks",
        "severity": "critical"
      }
    ]
  }
]

I don't know how to return just the "results" array (below), as you're asking for. @vjerci do you know if this is possible in rego?

[
      {
        "data_type": "Physical Address",
        "filename": "temp.rb",
        "line_number": 1,
        "policy_description": "Logger leaks detected",
        "policy_id": "detect_ruby_logger",
        "policy_name": "Logger leaks",
        "severity": "high"
      },
      {
        "data_type": "Unique Identifier",
        "filename": "temp.rb",
        "line_number": 1,
        "policy_description": "Logger leaks detected",
        "policy_id": "detect_ruby_logger",
        "policy_name": "Logger leaks",
        "severity": "critical"
      }
]