feat(java): detect setAccessible(true) reflective access on non-local members (CWE-284)

[ai-anant]

New rule in a new java/jenkins tree: detects reflective access switched on via setAccessible(true) (Java) or the Groovy property-assignment form accessible = true.

Why it matters: setAccessible(true) suppresses the language access checks, letting plugin code reach protected/private members of other classes - typically used to reach into framework internals and bypass the access-control/safety guardrails (permission checks, async isolation, timeouts, synchronization) that protect those APIs. Also breaks under the Java module system (InaccessibleObjectException).

Rule id: codevigilant.java.jenkins.reflection.setaccessible.true

• generic-mode rule so both the Java method-call and the Groovy property-assignment shapes are caught
• severity HIGH, confidence MEDIUM, metadata cwe/owasp/technology/references/license
• validated with semgrep 1.172 (semgrep --validate --config java/ clean)
• pos repro fires (2 matches incl. the Groovy form), neg repro (setAccessible(false) only) does not
• 4 hits across 30+ cloned Jenkins plugin sources, all genuine reflective-access instances, 0 false positives