feat(materials): record checkmarx engine types from SARIF via scan.types annotation
Enriches the SARIF crafter so a Checkmarx One SARIF report advertises the engines that produced its findings through the shared chainloop.material.scan.types annotation, mirroring the native CHECKMARX_JSON crafter (COM-372).
Checkmarx One bundles every engine (sast, sca, kics, containers, sscs) under a single driver, so the driver name alone cannot tell attestation-level policies which analyses actually ran. The engine type is recovered from the (engine) suffix ast-cli appends to every SARIF rule id, gated on Checkmarx detection (driver name or the checkmarx rule tag), and normalized onto the canonical scan-type vocabulary using the same map the native crafter uses (kics→iac, containers→container, sscs→supply-chain). Engines that cannot be classified are dropped, so recognition fails closed and never over-claims for other tools.
A Checkmarx SARIF and the equivalent native JSON report now yield the identical scan.types value, so the *-scan-present compliance policies can key on it uniformly regardless of material type once the compliance-manifests side ships.
This contribution was assisted by Claude Code.