Implement static code analysis rule to analyse weak encryption algorithm usage

[nureka-rodrigo]

Purpose

Fixes: ballerina-platform/ballerina-library#7940

Description

1. The analyzer is triggered when a FUNCTION_CALL node is encountered in the syntax tree.

2. It checks for a QualifiedNameReferenceNode with any prefixes used for the crypto module (both default crypto and any custom prefixes) and identifier encryptAesEcb or encryptAesCbc.

3. On match, the analyzer reports the vulnerability.

Checklist

• Linked to an issue
• Updated the changelog
• Added tests
• Updated the spec
• Checked native-image compatibility

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.22%. Comparing base (1d81d01) to head (dabb094).
Report is 3 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##             master     #602   +/-   ##
=========================================
  Coverage     82.22%   82.22%           
  Complexity      239      239           
=========================================
  Files            29       29           
  Lines          1367     1367           
  Branches        190      190           
=========================================
  Hits           1124     1124           
  Misses          197      197           
  Partials         46       46           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull Request Overview

This PR implements a static code analysis rule to flag the use of weak encryption algorithms (AES ECB/CBC) in Ballerina code. It updates configuration files, defines a new rule in the rules configuration, refactors the crypto rule into an enum, and adds a corresponding analyzer and tests to enforce the rule.

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
gradle.properties	Bumps the version for the balScan dependency.
compiler-plugin/src/main/resources/rules.json	Introduces a new vulnerability rule for weak encryption algorithm usage.
compiler-plugin/src/main/java/io/ballerina/stdlib/crypto/compiler/staticcodeanalyzer/CryptoRule.java	Refactors the crypto rule into an enum for better organization.
compiler-plugin/src/main/java/io/ballerina/stdlib/crypto/compiler/staticcodeanalyzer/CryptoCodeAnalyzer.java	Sets up the analyzer to trigger on function call syntax nodes.
compiler-plugin/src/main/java/io/ballerina/stdlib/crypto/compiler/staticcodeanalyzer/CryptoCipherAlgorithmAnalyzer.java	Implements the logic to detect weak cipher function invocations and scan import declarations.
compiler-plugin/src/main/java/io/ballerina/stdlib/crypto/compiler/CryptoCompilerPlugin.java	Updates the compiler plugin to register the new code analyzer using the scanner context.
Remaining test files	Add test cases and expected outputs to validate the rule’s behavior.

[daneshk]

LGTM