Associate descriptor metadata with thread flow locations

[michaelcfanning]

TC approves:

Add threadFlowLocation.taxa, an array of reportingDescriptorReferences, the default location of which (in case where only the RDR index is provided) is the relevant tool component rules data.

[michaelcfanning]

@lgolding to author example using MicroFocus inputs. Follow up with Chris Meyer and Scott Louvau to get substantive examples.

From Larry: I got the sample from Yekaterina. Our design will work. I'll author the example as I write the spec text.

[ghost]

For completeness, here's the sample:

{                                # A run object (§3.14).
  "tool": {                      # See §3.14.6.
    "driver": {
      "name": "TaintDetector",
      "rules": [
        {
          "id": "TD0001",
          "name": "UntrustedDataStoredInDatabase",
          "shortDescription": {
            "text": "Data from an untrusted source was stored in a database."
          }
        },
        ...
      ],
      "taxa": [                  # Custom taxonomy (§3.19.3) for helper rules.
        {                        # A reportingDescriptor object (§3.48).
          "id": "HR0001",
          "name": "SubstrPropogatesTaint",
          "shortDescription": {
            "text": "If the input to String.Substr is tainted,
                     so is the return value."
          }
        },
        ...
      ]
    }
  },

  "results": [                   # See §3.14.22.
    {                            # A result object §3.26.
      "ruleId": "TD0001",
      ...
      "codeFlows": [             # See §3.26.18.
        {                        # A codeFlow object (§3.35).
          "threadFlows": [       # See §3.35.3.
            {                    # A threadFlow object (§3.36).
              "locations": [     # See §3.36.6.
                ...
                {                # A threadFlowLocation object.
                  "location": {  # See §3.37.3.
                    "physicalLocation": {
                      "artifactLocation": {
                        "uri": "io/input.c",
                        "uriBaseId": "SRCROOT"
                      },
                      "region": {
                        "startLine": 32
                      }
                    }
                  },
                  "taxa": [
                    {        # A reportingDescriptorReference object (§3.51).
                      "id": "TD0001",
                      "index": 0
                    }
                  ]
                },
                ...
              ]
            }
          ]
        }
      ]
    }
  ]
}

[kupsch]

In the example above and in the draft for 381, should the taxa id value in the threadFlow be "HD0001" not "TD0001"?