[SizzleUnrlsd]

Closes #242.

A SARIF rule took its id as shortDescription and had no fullDescription, so GitHub code scanning named an alert after the id and explained nothing. CoreTrace, which links the analyzer, had no text for it either.

Changes

• Catalog: describeRule(ruleId), in the new public header include/RuleCatalog.hpp, gives a title and a description for each of the 52 rule ids the emitters can give:
  • the explicit ids;
  • the four ConstParameterNotModified variants;
  • the clang classifications;
  • the error code names, which a diagnostic without an explicit id takes.
• SARIF: a rule's shortDescription is its title and its fullDescription its description. An id the catalog does not describe keeps itself as shortDescription, as before.

Files left untouched on purpose

Open PRs #221 and #239 change StackUsageAnalyzer.hpp, DiagnosticEmitter.cpp, CMakeLists.txt, README.md and run_test.py. This PR changes none of them:

• the catalog has its own header, and its definition sits in src/report/ReportSerialization.cpp, the SARIF writer, so the source list does not change;
• the test is a unit test.

#243 (the human layout in the JSON and SARIF messages) and #244 (related locations and a confidence level) rework DiagnosticEmitter.cpp and the Diagnostic model, so they will come after #221 and #239 are merged.

Tests

testEveryRuleIsDescribed was committed first and failed for every rule (52):

• it reads the rule ids from the emitters' sources, as testEveryReportedCweIsScored reads the CWEs, so a new rule without a description fails it;
• it checks that the SARIF rule has a title other than its id and a description.

Results:

• Unit tests pass.
• run_test.py: 2415/2415.
• clang-format 20 and the license compliance check pass.
• A real run on a stack overflow and a recursion gives valid SARIF with the texts.