feat(java): detect process launch with a workspace-resolved executable path (CWE-427/94)

[ai-anant]

Detects a Jenkins build step that launches a process with a command vector whose executable path is resolved from a FilePath inside the build workspace (workspace.child(...) / FilePath.child(...)). Workspace content can be attacker-influenceable (SCM checkout, shared agent workspace, earlier build steps); executing a workspace-resolved file without verifying authenticity can lead to arbitrary code execution in the build context and exposure of credentials placed in the process environment.

[ai-anant]

Consolidated from the aqua-serverless round: the "workspace-resolved path" source family now also covers string-concatenated workspace paths (FilePath.toString() == getRemote(), e.g. args.add(ws + "/bin", ...)) whose download target failed silently, plus the add() sink now matches any argument position ($X.add(..., $T, ...)) scoped to command-vector receivers to keep collection adds out. Validated: fires on both shapes, no FPs over 100 jenkinsci plugin sources.