Add Apex and VisualForce rules

[garretpatten-ncino]

Changes

• Add the following Apex rules:
  • GlobalAccessModifiers
  • ApexCSRFConstructor
  • ApexCSRFStaticConstructor
  • DmlNativeStatements
  • BadCrypto
  • InsecureHttpRequest
  • NamedCredentialsConstantMatch
  • NamedCredentialsStringMatch
  • ApexSOQLInjectionFromUnescapedURLParam
  • ApexSOQLInjectionUnescapedParam
  • SpecifySharingLevel
  • SystemDebug
  • UseAssertClass
  • AbsoluteUrls
  • AvoidNativeDmlInLoops
  • AvoidOperationsWithLimitsInLoops
  • AvoidSoqlInLoops
  • AvoidSoslInLoops
• Add the following VisualForce rules:
  • CSPHeaderAttribute
  • UseSRIForCDNs (also applies to HTML but being added just to VF set here)
  • VisualForceAPIVersion
  • XSSFromUnescapedURLParam

Outstanding Questions

• We have some rules (Semgrep versions of existing open source PMD rules) around Apex performance and best practices. Not sure if they belonged in this PR or not; for now, they've been included.
• Guidance was initially given to include technology: ncino in the metadata of each rule, but Apex and VisualForce are Salesforce languages/frameworks. We thought it would be more appropriate to include technology: salesforce. With that, would it make sense to add another metadata entry for contributor: ncino or something like that?

[CLAassistant]

All committers have signed the CLA.

[p4p3r]

LGTM