feat: add private repository support with PAT and SSH authentication

[vbelouso]

Add support for private GitHub repository authentication using PAT and SSH keys.

Changes:

• Credential-based git authentication (PAT and SSH)
• Graceful fallback when credentials expire or CA bundle missing
• Enhanced GitHub API with user tokens for language detection
• Ecosystem fallback when API returns no languages

Review together with RHEcosystemAppEng/agent-morpheus-client#138

Testing:

1. For testing, you need an accessible private repository with your PAT/SSH

And a minimal SBOM, for example, as in the attachment
Update metadata.component.name and metadata.properties with the actual values.
eiq-private-clone-test.json

2. A test instance is available in the OpenShift project daboogie-eiq-private

[zvigrinberg]

Hi @vbelouso
The solution is great, and meeting all expectations.

Please see my comments.

[zvigrinberg]

@vbelouso LGTM , Very good job!.
Please only merge after the client side is ready for merge as well...

Thank you!.

[zvigrinberg]

@vbelouso Not critical, But when i tested it locally, i couldn't do it, without adding this piece of code

diff --git a/src/exploit_iq_commons/utils/credential_client.py b/src/exploit_iq_commons/utils/credential_client.py
index b611421..3ca339e 100644
--- a/src/exploit_iq_commons/utils/credential_client.py
+++ b/src/exploit_iq_commons/utils/credential_client.py
@@ -187,8 +187,12 @@ def fetch_and_decrypt_credential(
 
     logger.info("Fetching credential: credential_id=%s", credential_id)
 
-    ca_bundle = os.environ.get("CLIENT_CA_BUNDLE", "/app/certs/service-ca.crt")
-    verify_ssl = _validate_ca_bundle(ca_bundle)
+    if url.startswith("https"):
+        ca_bundle = os.environ.get("CLIENT_CA_BUNDLE", "/app/certs/service-ca.crt")
+        verify_ssl = _validate_ca_bundle(ca_bundle)
+    else:
+        verify_ssl = False
+
 
     try:
         response = requests.get(url, headers=headers, timeout=10, verify=verify_ssl)

and without adding the following 2 environment variables before running the agent

CLIENT_JWT_TOKEN=dummy_token
CLIENT_BACKEND_URL=http://localhost:8080

I Would suggest commenting out the above piece of code I've added and add comment about that this is essential for debugging or invoking the agent locally for analysis of private git repositories, and on the way, add another comment with these 2 env vars required for that purpose.

[vbelouso]

/test vulnerability-analysis-on-pr

[vbelouso]

/test vulnerability-analysis-on-pr

[vbelouso]

/test vulnerability-analysis-on-pr

[vbelouso]

/test vulnerability-analysis-on-pr