feat(java): detect Jelly form-entry title/description expressions rendered unescaped (CWE-79)

[ai-anant]

Adds a Jenkins/Jelly rule:

codevigilant.java.jenkins.xss.jelly-entry-unescaped-expression — fires on Jelly
views that disable form-entry escaping (escapeEntryTitleAndDescription=false)
and bind a ${...} expression to an f:entry/f:block title or description
attribute where the expression is neither wrapped in h.escape(...) nor the
MarkupFormatter-sanitized formattedDescription/getFormattedDescription
getter. Config- or user-controlled content reaching such an attribute is emitted
as raw HTML in the Jenkins UI, enabling stored XSS (CWE-79).

Generic vulnerable shape:

• <j:set var="escapeEntryTitleAndDescription" value="false"/>
• <f:entry ... description="${it.someCustomDescriptionMethod()}" ...>

Safe shapes excluded via regex lookaheads: h.escape-wrapped expressions and
formatter-sanitized formattedDescription/getFormattedDescription bindings.

Implementation note: Jelly files are XML; semgrep has no XML language, so the
rule runs in generic mode using pattern-inside (escape flag present) plus a
pattern-regex for the unescaped attribute binding. Validated with
semgrep --validate; tested against a positive repro (2 vulnerable entries -
fires) and a negative repro (h.escape/formattedDescription/literal bindings -
no findings).