Do not remove findings with same range but different metavariables

[aryx]

This closes #3279

test plan:
test file included
and
semgrep --config ~/yy/tests/OTHER/rules/misc_field.yaml
~/yy/tests/OTHER/rules/misc_field.js

returns now 22 findings (same range though).

PR checklist:

• changelog is up to date

[aryx]

(semgrep) [pad@yrax semgrep (no_dedup)]$ semgrep --config ~/yy/tests/OTHER/rules/misc_field.yaml ~/yy/tests/OTHER/rules/misc_field.js
running 1 rules...
/home/pad/yy/tests/OTHER/rules/misc_field.js
severity:warning rule:home.pad.yy.tests.OTHER.rules.my_pattern_id: "web-vitals" looks like a new dependency! Please check this on https://deps.dev/npm/"web-vitals"/"^0.2.4" to make sure its license is legit, doesn't have lots of known security issues, and that it has enough users.

2:{
3:  "name": "frontend",
4:  "version": "0.1.0",
5:  "private": true,
6:  "dependencies": {
7:    "@fortawesome/fontawesome-svg-core": "^1.2.32",
8:    "@fortawesome/free-regular-svg-icons": "^5.15.1",
9:    "@fortawesome/free-solid-svg-icons": "^5.15.1",
10:    "@fortawesome/react-fontawesome": "^0.1.12",
11:    "@testing-library/jest-dom": "^5.11.4",
-------- [hid 19 additional lines, adjust with --max-lines-per-finding] --------
severity:warning rule:home.pad.yy.tests.OTHER.rules.my_pattern_id: "typescript" looks like a new dependency! Please check this on https://deps.dev/npm/"typescript"/"^4.0.3" to make sure its license is legit, doesn't have lots of known security issues, and that it has enough users.

2:{
3:  "name": "frontend",
4:  "version": "0.1.0",
5:  "private": true,
6:  "dependencies": {
7:    "@fortawesome/fontawesome-svg-core": "^1.2.32",
8:    "@fortawesome/free-regular-svg-icons": "^5.15.1",
9:    "@fortawesome/free-solid-svg-icons": "^5.15.1",
10:    "@fortawesome/react-fontawesome": "^0.1.12",
11:    "@testing-library/jest-dom": "^5.11.4",
-------- [hid 19 additional lines, adjust with --max-lines-per-finding] --------
...

[emjin]

Relevant slack conversation:
https://returntocorp.slack.com/archives/C01AX0QCEET/p1622757347088700

[github-actions]

Potential non-blocking slowdown latest time 3.996 is over 12 percent slower than baseline 3.519. See run output for more details

[aryx]

We got a big release, so This is potentially a big change so I wait for the release cut to merge this.

[stale]

This pull request is being marked stale because there hasn't been any activity in 30 days. Please leave a comment on the pull request to keep it open. Otherwise, we'll close this pull request in 7 days (you can always reopen it later).

[ievans]

I don't see any test that has 22 extra findings @aryx, am I missing something?

[aryx]

This works now on develop: https://semgrep.dev/s/2b25?version=develop