#3292 feat(materials): record checkmarx engine types via scan.types annotation

Description

The Checkmarx One native JSON report (CHECKMARX_JSON) is multi-engine: a single report can bundle SAST, SCA, KICS (IaC) and container findings. At the attestation level, the crafter previously injected only chainloop.material.tool.name = checkmarx, so there was no way to tell which engines actually produced findings.

This change has the Checkmarx crafter record the distinct engine types present in the report as a new chainloop.material.scan.types annotation (lower-cased, sorted, comma-joined; e.g. kics,sast,sca). Annotation-only consumers can then distinguish engines without reading material content. A clean or null report advertises no types, so the annotation is omitted rather than set empty.

AI disclosure

This contribution was assisted by Claude Code.