feat: add CHECKMARX_JSON material type
Adds support for ingesting Checkmarx One native JSON reports (the ast-cli ScanResultsCollection produced by cx ... --report-format json) as a new CHECKMARX_JSON material type.
Unlike the existing SARIF ingestion path, the native format preserves fields SARIF drops — the triage state, similarityId, Checkmarx query metadata, and CVSS/CWE details — which lets policies act on already-triaged findings. A single report can bundle multiple engines (SAST, SCA, KICS, containers, secrets), distinguished per result by type.
The crafter validates the report structure (top-level scanID and a results key, plus a type and data payload on each result) to reject look-alike JSON, accepts clean scans where results is empty or null, and records the report verbatim for policy evaluation. The kind is omitted from auto-detection and must be referenced with an explicit --kind CHECKMARX_JSON.
Assisted-by: Claude Code