fix(policies): policy determines severity of policy breach

[elsapet]

Description

• Add category "groups" (personal, sensitive - could be PII, PHI) with a mapping for customisability
• In logger policy, set severity based on category group
• In logger policy, remove data type name and add category group name

Having policies determine severity level is more flexible and allows different policies to have different severity levels for e.g. different categories. Of course, not all policies will care about data categories, but the severity concept will be inside policies themselves.

Output now with category group (Sensitive, Personal data) instead of data type:

[
  {
    "result": [
      {
        "category_group": "Personal data",
        "filename": ".",
        "line_number": 3,
        "policy_description": "Logger leaks detected",
        "policy_id": "detect_ruby_logger",
        "policy_name": "Logger leaks",
        "severity": "high"
      },
      {
        "category_group": "Personal data",
        "filename": ".",
        "line_number": 5,
        "policy_description": "Logger leaks detected",
        "policy_id": "detect_ruby_logger",
        "policy_name": "Logger leaks",
        "severity": "high"
      },
      {
        "category_group": "Personal data",
        "filename": ".",
        "line_number": 10,
        "policy_description": "Logger leaks detected",
        "policy_id": "detect_ruby_logger",
        "policy_name": "Logger leaks",
        "severity": "high"
      },
      {
        "category_group": "Sensitive data",
        "filename": ".",
        "line_number": 4,
        "policy_description": "Logger leaks detected",
        "policy_id": "detect_ruby_logger",
        "policy_name": "Logger leaks",
        "severity": "critical"
      }
    ]
  }
]
]

Checklist

• I've added test coverage that shows my fix or feature works as expected.
• I've updated or added documentation if required.
• I've included usage information in the description if CLI behavior was updated or added.
• PR title follows Conventional Commits format

[swarmia]

✅  Linked to AMA-3243 · Add mapping between data category and PHI / PII and use to calculate policy severity
➡️  Part of AMA-3203 · Policies: OPA Implementation
➡️  Part of AMA-2947 · OSS - Curio CLI