SONARPY-4248 Add support for bandit's # nosec directive

[teemu-rytilahti-sonarsource]

Summary

• Extend NoSonarInfoParser to recognize # nosec comments (case-insensitive, colon or whitespace separator, trailing description allowed).
• # nosec produces a NoSonarLineInfo with an empty suppressed-rule-key set, which the existing NoSonarIssueFilter already interprets as "suppress all rules on this line" — no filter changes needed. As a result, # nosec silences e.g. S4790 on the offending line, matching bandit's own semantics.
• Tests added to NoSonarInfoParserTest (bare, # nosec B101, with reason, colon form, uppercase, length-truncated, mixed with another # segment) and end-to-end cases in NoSonarLineInfoCollectorTest.

Sibling of SONARGO-809 (Go //nolint). Tracked as SONARPY-4248.

Follow-up

Bandit also supports test IDs (# nosec B303, B607). The repo has no Bandit-ID → Sonar-rule mapping today, so anything after nosec is parsed as free-form description and BXXX IDs are not honored.

A nicer behaviour for bare # nosec would be to suppress only security-typed rules (71 rules with type: VULNERABILITY or SECURITY_HOTSPOT under python-checks/.../l10n/py/rules/python/*.json) rather than everything on the line, closer to user intent. That would require:

1. Adding a discriminator on NoSonarLineInfo (e.g. SuppressionScope.SECURITY_ONLY).
2. Pre-computing the set of security rule keys at scanner startup (the metadata is already loaded by AbstractPythonRuleRepository via RuleMetadataLoader).
3. Updating NoSonarIssueFilter to consult that set when the line's scope is SECURITY_ONLY.

Out of scope for this PR; can land as a follow-up under the same ticket.

Test plan

• mvn test -Dtest=NoSonarInfoParserTest in python-frontend (68 tests pass).
• mvn test -Dtest=NoSonarLineInfoCollectorTest in python-commons (collector test cases added but not run locally — python-commons needs python-frontend installed; CI will cover).
• Manually verify # nosec on a hashlib.md5(...) line suppresses S4790.

[gitar-bot]

Code Review ✅ Approved

Extends the NoSonarInfoParser to recognize Bandit's # nosec directive, enabling line-level suppression of all rules. Comprehensive tests verify the parser's case-insensitive handling and support for trailing descriptions.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}