fix(rules): narrow sql-concat, debug-enabled, hardcoded-role patterns

[ajianaz]

What

Three security scanner rules produced false positives or false negatives due to overly broad or overly narrow regex patterns. This PR narrows and adds post-match filters for each, following the same 3-layer defense approach established in #484.

Why

#485 — injection/sql-concat flagged comments, prose, and non-SQL concatenation. The old regex (?i)(?:SELECT|INSERT|UPDATE|DELETE)\s+.*\+ matched any SQL keyword followed by + anywhere — including // SELECT a + b and let total = a + b; // UPDATE: not SQL.

#486 — config/debug-enabled flagged CLI flags, argument parser definitions, and Dockerfile RUN commands. The old regex included --debug which is a CLI convention, not a config assignment.

#490 — auth/hardcoded-role missed the most common real-world pattern: quoted role comparisons. The old regex only matched bareword role == admin (rare outside Ruby/PHP), missing role == "admin" (JS, TS, Python, Go), user.role === "admin" (property access + strict equality), and "superuser".

Closes #485, closes #486, closes #490.

How

injection/sql-concat (security_scanner.rs):

• Narrowed regex to require SQL keyword inside a string literal before matching +
• Added format!("SELECT ...") pattern for Rust format macros
• Added is_false_positive_sql_concat() post-match filter: suppresses comment lines (//, #, --, /*, *) and docstrings

config/debug-enabled (security_scanner.rs):

• Removed --debug from regex — too many false positives in dev tooling
• Kept DEBUG = True, debug: true, added debug = true
• Added is_false_positive_debug() post-match filter: suppresses comment lines, argument parser definitions (add_argument, .option(, parser.), and env var references

auth/hardcoded-role (security_scanner.rs):

• Rewrote regex to accept optional quotes (["']?), strict equality ([=]{2,3}), property access ((?:\w+\.)*role), and superuser
• Now covers: role == "admin", user.role === 'super', if role === "superuser", etc.

Testing

• cargo test --features tree-sitter passes — 854 tests, 0 failures (18 new tests added)
• cargo fmt --all -- --check passes
• cargo clippy --all-targets --features tree-sitter -- -D warnings passes
• cargo build --release --features tree-sitter passes
• Manual verification: each false positive example from issues Static security scanner false positive: injection/sql-concat matches comments and non-SQL concatenation #485, Static security scanner false positive: config/debug-enabled matches legitimate CLI flags #486, auth/hardcoded-role regex misses quoted role comparisons (most common pattern) #490 confirmed suppressed; each true positive confirmed still detected

New test coverage:

• 5 sql-concat tests (real injection, format! macro, 3 false positive cases)
• 5 debug-enabled tests (real assignment, YAML config, CLI flag, argument parser, comment)
• 8 hardcoded-role tests (unquoted, double/single quotes, strict equality, property access, super/root/superuser)

Related Issues

Closes #485, closes #486, closes #490
Part of epic #487

Checklist

• Branch name follows convention (fix/)
• Branch is from develop
• Commit messages follow Conventional Commits
• No secrets or credentials committed
• One logical change per PR (security scanner rule fixes from Static security scanner false positive: injection/sql-concat matches comments and non-SQL concatenation #485 + Static security scanner false positive: config/debug-enabled matches legitimate CLI flags #486 + auth/hardcoded-role regex misses quoted role comparisons (most common pattern) #490)