fix(sarif): helpUri fallback to source-rule-url (was #10891) (#10934)

This is contribution by @candrews.

When exporting Semgrep findings to SARIF, the `metadata.source-rule-url` field of the Semgrep rule is now used as a fallback to populate the `helpURI` field in the output if `metadata.source` isn't available.

---------

Co-authored-by: Craig Andrews <candrews@integralblue.com>

Author: Martin Jambon

changelog.d/gh-10891.fixed

@@ -0,0 +1,11 @@
+In a Semgrep rule's `metadata` section, two fields may provide URLs:
+
+- `source`: populated dynamically by the Semgrep registry serving the rule, it's a URL that
+  offers information about the rule.
+- `source-rule-url`: optional string, a URL for the source of inspiration for the rule.
+
+The SARIF format supports only one URL under the field `helpUri`.
+Previously, Semgrep populated the SARIF `helpUri` field only with `metadata.source`.
+This fix is to use `metadata.source` if available, otherwise falling back to `metadata.source-rule-url`.
+
+Contributed by @candrews.

cli/tests/default/e2e/rules/source_rule_url.yaml

@@ -0,0 +1,10 @@
+# This test rule is for checking that the SARIF output contains
+# the URL provided by metadata.source-rule-url
+rules:
+  - id: source-rule-url
+    pattern: print(...)
+    message: "found"
+    languages: [python]
+    severity: ERROR
+    metadata:
+      source-rule-url: https://example.com/print

cli/tests/default/e2e/rules/source_url.yaml

@@ -0,0 +1,12 @@
+# This test rule is for checking that the SARIF output contains
+# the URL provided by metadata.source
+rules:
+  - id: source-url
+    pattern: print(...)
+    message: "found"
+    languages: [python]
+    severity: ERROR
+    metadata:
+      source-rule-url: https://example.com/incorrect-url
+      # This URL should be preferred:
+      source: https://example.com/correct-url

cli/tests/default/e2e/snapshots/test_output_sarif/test_sarif_output/False-rule_and_target3/results.sarif

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json",
+  "runs": [
+    {
+      "invocations": [
+        {
+          "executionSuccessful": true,
+          "toolExecutionNotifications": []
+        }
+      ],
+      "results": [],
+      "tool": {
+        "driver": {
+          "name": "Semgrep OSS",
+          "rules": [
+            {
+              "defaultConfiguration": {
+                "level": "error"
+              },
+              "fullDescription": {
+                "text": "found"
+              },
+              "help": {
+                "markdown": "found\n\n<b>References:</b>\n - [Semgrep Rule](https://example.com/print)\n",
+                "text": "found"
+              },
+              "helpUri": "https://example.com/print",
+              "id": "rules.source-rule-url",
+              "name": "rules.source-rule-url",
+              "properties": {
+                "precision": "very-high",
+                "tags": []
+              },
+              "shortDescription": {
+                "text": "Semgrep Finding: rules.source-rule-url"
+              }
+            }
+          ],
+          "semanticVersion": "<MASKED>"
+        }
+      }
+    }
+  ],
+  "version": "2.1.0"
+}