feat(security): SEC003 / SEC005 / SEC008 multi-language strengthen (PR #19)

[wei9072]

Summary

Continues PR #18's audit. The three rules I marked "decent
multi-language coverage" each had specific gaps that surface in
real-world auth / DB / serialization code.

SEC003 — TLS verification disabled

Added	Pattern
PHP curl	`CURLOPT_SSL_VERIFYPEER => false/0`, `CURLOPT_SSL_VERIFYHOST => 0`; both positional and inline-array forms
Ruby OpenSSL	`VERIFY_NONE` / `OpenSSL::SSL::VERIFY_NONE`
Java	`NoopHostnameVerifier` / `TrustAllHostnameVerifier` class names

Deferred-via-variable PHP form intentionally not caught (needs
dataflow). Java arbitrary anonymous-inner-class trust managers
also out of scope.

SEC005 — SQL string concat

Receiver-method matcher expanded across families:

• JDBC: + `executeLargeUpdate`, `executeBatch`
• Go / Node.js: + `Query` / `QueryRow` / `QueryContext` /
  `Exec` / `ExecContext`
• PHP PDO: + `exec`, `prepare`
• Ruby: + `find_by_sql`
• PHP global: + `mysqli_query` / `mysql_query` / `pg_query` / `sqlite_query`

Plus three under-the-hood fixes:

1. `leaf_method_name` used to support PHP `::` / `->` separators
2. `text_has_interp` (from PR feat(security): SEC004 + SEC007 multi-language dispatch (PR #18) #18) replaces SEC005's Python-shaped
   local check, picking up PHP `.` concat
3. `contains_sql_in_string_literal` extended to recognise PHP's
   `encapsed_string` + `string_value` plus heredoc / template
   literal kinds — so the SQL-keyword gate sees the string content
   in PHP code

SEC008 — insecure deserialization

Dangerous-call list extended across 5 languages:

Language	Added
Python	+ `shelve.open`, `dill.loads`, `dill.load`
Java	+ `XMLDecoder.readObject`
PHP	+ `unserialize` (textbook unsafe path)
Ruby	+ `Marshal.load`, `YAML.load`, `Oj.load`
C# / .NET	+ `BinaryFormatter.Deserialize`, `SoapFormatter.Deserialize`, `NetDataContractSerializer.ReadObject`
Go	+ `gob.NewDecoder`

Tests

7 new (SEC003 PHP curl ×3, SEC005 Go db.Query + PHP mysqli_query,
SEC008 PHP unserialize + C# BinaryFormatter).

`cargo test --workspace`: 184 → 191 tests pass.

Test plan

• All new SEC003/005/008 tests pass
• No regression on existing 184 tests
• PHP `encapsed_string` reaches contains_sql_in_string_literal
  walker
• CURLOPT_SSL_VERIFYPEER 1 (safe value) stays silent
• CI green on push

🤖 Generated with Claude Code