Fix the audit's weak spots: injection and hardcoded-value considers, TLS and escape reviews

[tauanbinato]

Follows #26 and #27. The audit left four weak spots in findings people read:

• hardcoded-value considers that rest on a value needing a name (41% right)
• injection considers that rest on a function's parameters (37% right)
• TLS reviews on connections that use no TLS
• an escape review on i18next in a React Native app

Each gets a follow-up asked only for such findings, or a reworded check.

What changes

• Injection: a consider that rests on the function's parameters ("a caller passing outside input would make it exploitable") is asked, with the functions that call it, what the values it places can hold.
  • It becomes a note when the program's own values lead: text the program fixes (literals its callers pass, numbers, names from a fixed list), values it creates, or a local tool's own arguments.
  • Text another party can set, or callers that aren't shown, keep it.
  • Why a new question: the recheck's origin question answered "the function's parameters" at 0.9 even for a Rust helper whose four callers pass literal SQL fragments, and that answer isn't wrong.
• Hardcoded values: the locate Choice lists, with each value, the other lines of its file that write it. A consider that rests only on a value's name, and whose file writes that value again, is then asked what the value is.
  • Copies that must change together, or a value nothing explains, keep it.
  • A value explained by the field or argument it fills or a comment beside it, an idiom (a tolerance near zero, a half, a unit conversion) or a hand-tuned number make it a note, when those options together reach 0.65, the threshold for a clear located part.
• Unsafe settings: outside C#, PHP and Django, the TLS check asks whether code accepts a server's certificate, host key or host name without verifying it.
  • A connection made without TLS (gRPC's insecure credentials, an insecure OpenTelemetry exporter, sslmode=disable) presents nothing to verify.
  • Verification skipped only when a caller or the operator asks for it isn't turned off.
  • The escape check names i18next's escapeValue: false in a React app as escaping kept.

Results

Labeled findings on the tuned and fresh projects (not held out), main → this branch:

	Right	Wrong	Share right
Injection considers resting on parameters	30 → 30	51 → 32	37% → 48%
Hardcoded "must guess" considers	53 → 32	77 → 28	41% → 53%
Unsafe-settings reviews	54 → 54	24 → 14	69% → 79%
All reviews	519 → 519	188 → 179	73% → 74%
All considers	850 → 830	404 → 337	68% → 71%

• Against 0.20.0 on the 72 tuned projects: 76% of reviews right (142 wrong, from 192) and 73% of considers (239 wrong, from 355).
• 14 fresh projects: 64% of reviews and 65% of considers right, against 53% and 47% with 0.20.0 and 59% and 57% with main.
• 11 held-out projects: one fewer wrong review, otherwise unchanged. They hold few findings of these kinds.
• 13 findings are new or changed and were labeled: 3 right, 9 wrong, 1 debatable. Most are hardcoded values the new locate evidence named. RailsGoat's API token check against a salt written in the code is a new right review, and a CORS setting in a development-only settings module is a new wrong one.
• Corpus cost, all iterations included: about $0.4.

Review notes

• What was lost:
  • pgweb's bookmark reader defaulting sslmode to disable for remote servers was a right review and is now a note. It drops TLS rather than verification, which the finding's message misdescribed.
  • 21 right hardcoded-value considers are notes. Most are values whose copies must stay equal, which the model also read as idioms.
• What didn't work:
  • The first TLS rewording only added examples to the check's "no" (plaintext to services of the same deployment, then any plaintext). Online Boutique's gRPC clients stayed reviews with both, so the question itself changed.
  • For hardcoded values, offering the readable kinds as the locate's "none" turned 6 right considers into notes for 17 wrong ones.
  • Telling the kind Choice that copies win over the other kinds made it pick copies for wrong considers too: 22 notes instead of 42.
• Request changes:
  • Injection: only the new follow-ups are asked. Rechecks share their state builder with them, and their requests are byte-identical, so the cache still answers them.
  • Hardcoded values: the locate follow-ups change.
  • Unsafe settings: unsafe-settings traces outside C#, PHP and Django change.
• Self-check: the branch's self-check leaves no unbaselined review or consider. It had flagged the new follow-up's state as a copy of the recheck's, now shared. CI's review runs the released 0.20.0 and adds one consider on asked_checks in src/units/security.rs ("mixes separate jobs"). That function is unchanged here, and this branch's rules don't flag it.