feat: add code actions, fix ostest & feature flags [IDE-1493]

[bastiandoetsch]

Description

This PR refactors the OSS vulnerability processing and feature flag infrastructure, adds risk score display functionality, and improves code maintainability through better separation of concerns.

OSS Issue Processing Refactoring:

• Extracted code actions logic: Moved code action generation from inline logic into dedicated addCodeActionsAndLenses() helper function for better testability and reuse
• Made functions stateless: Converted instance methods on ossIssue to standalone functions (GetExtendedMessage, createCveLink, createCweLink, createFixedIn, CreateIssueURL, GetCodeActions, AddSnykLearnAction, AddQuickFixAction) - removing tight coupling to the ossIssue struct
• Improved converter architecture:
  • Extracted getAffectedFilePath() helper to reduce code duplication
  • Moved getFileContent() into shared utility function
  • Simplified ProcessScanResults() signature by using context for dependency injection
  • Better error handling and logging throughout conversion pipeline
• Simplified remediation logic: Removed patchable-specific branches in GetRemediation() - now only handles upgrade paths
• Context-based dependency injection: Config, learn service, and error reporter now passed via context instead of function parameters

Risk Score Feature (IDE-1493):

• Added RiskScore field to OssIssueData struct
• Updated HTML template (details.html) to conditionally display risk score when non-zero
• Added feature flags UseExperimentalRiskScore and UseExperimentalRiskScoreInCLI to control risk score functionality
• Risk score properly flows from test API through to issue display

Feature Flag Infrastructure Overhaul:

• Migrated to imcache: Replaced plain map[string] with imcache.Cache for both feature flags and SAST settings storage
• Added cache expiration: All cached entries expire after 1 minute to ensure freshness
• Introduced Option pattern: Added WithProvider() option for cleaner dependency injection and improved testability
• Thread-safety improvements: Leverages imcache's built-in concurrency handling, reducing manual mutex complexity
• Automatic persistence: PopulateFolderConfig() now automatically persists folder config via storedconfig.UpdateFolderConfig()
• Test simplification: All feature flag tests updated to use new New() constructor with options

Test Infrastructure Improvements:

• Optimized test repo cloning: Modified unified test API smoke test to clone test repository only once and reuse across test runs
• Fixed comparison test: Updated diagnostic comparison logic to use Code + Range as matching key instead of relying on OssIssueData internal fields
• Separated dependency injection: Cleaner DI setup for unified test API smoke test
• Adjusted test expectations: Updated to match new issue structure and findings format

Other Changes:

• Updated copyright headers to 2025
• Fixed go.mod/go.sum inconsistencies
• Minor adjustments to scanner and converter call sites

Files Changed: 26 files (+549/-588 lines)

Checklist

• Tests added and all succeed
• Regenerated mocks, etc. (make generate)
• Linted (make lint-fix)
• README.md updated, if user-facing
• License file updated, if new 3rd-party dependency is introduced

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.