Docs/ast v2 update

[JAugusto42]

What this changes

Brings the Conviso AST documentation in line with the CLI that ships today, across the
product pages and every CI/CD integration guide. No page describes a "v2": the product is
Conviso AST, and the engines are conviso sast, conviso sca, conviso iac,
conviso sbom, conviso secret and conviso container.

Command surface

• conviso ast run is the documented entry point everywhere, replacing the bare
  conviso-ast invocation in the four orchestrator guides and their flow diagrams.
• --vulnerability-auto-close is gone from every example. Closing fixed vulnerabilities is
  the default behavior, and the flag is accepted only as a no-op — keeping it in the docs
  taught people to pass something that does nothing.
• --start-commit / --end-commit give way to BASELINE_REF / BASELINE_COMMIT, which is
  how a diff-aware scan is scoped now. The GitLab example also sets GIT_DEPTH: "0",
  without which the baseline commit is not in the clone.
• Each page lists what a scan actually covers: SAST, SCA, IaC, SBOM and secrets. The old
  pages still promised "Code Review" and stopped at SAST + SCA.

Environment and image

• CONVISO_APIKEY / CONVISO_BASE_URL become CONVISO_API_KEY / CONVISO_API_URL in the
  orchestrator templates. CONVISO_BASE_URL was never read by anything — those pipelines
  were falling back to the default API URL and the docs made that invisible.
• The image is convisoappsec/convisoast. This depends on the release side: the deploy
  workflow currently publishes convisoappsec/convisoast_v2 only, with the second name
  commented out. Merging before that is restored points readers at a stale image.

Pages reworked

• Conviso AST — rewritten around the current command reference, asset resolution, branch
  detection, environment variables, dry-run mode and troubleshooting.
• Security Gate — states that the gate is a step of its own (a scan never fails a build
  on findings), that it evaluates one branch, that it never creates an asset, and that
  conviso vulnerability assert-security-rules is deprecated. The YAML-based section no
  longer documents a legacy output format that the CLI stopped producing.
• Jenkins (single pipeline) — drops the project-code mapping function. The scan resolves
  the asset from the remote, so a webhook from a new repository works with no pipeline edit.
• SBOM / Containers / Vulnerability management — corrected to match reality: SBOM comes
  from conviso ast run or conviso sbom generate (not from conviso sca run), the
  container prerequisite is the Conviso AST image, and auto-close needs no flag.

--asset-name is documented as being discontinued

--asset-name / CONVISO_ASSET_NAME now carries a deprecation warning on the AST page, a
row in the scan options table and a row in the environment variables table, all pointing at
--asset-id / CONVISO_ASSET_ID. The reasoning is in the page: a name is not an identity —
two assets in the same company can share one, and a name that stops resolving sends the scan
to an asset nobody chose.

Validation

The last commit fixes what did not survive a check against the CLI source (conviso-ast-v2
4.0.0):

• The branch option is --branch-name. -b / --branch is not a spelling the parser
  knows: it is dropped with an "unknown argument" warning, and the scan silently reports to
  whatever branch git resolves to. It was wrong in four places, including the security gate.
• Removed a link to a "Migrating from the previous CLI" section that does not exist.
• The CLI does not check its version against a platform-side minimum at startup, and no scan
  is stopped for being outdated. Both claims were replaced by what a pinned tag actually
  costs.
• The Codefresh sample output announced version 0.3.9.
• CONVISO_BRANCH_NAME was undocumented despite outranking CONVISO_BRANCH and every CI
  variable.

yarn build passes, and the broken anchor this branch had introduced is gone. The eight
anchors still reported are pre-existing on main and untouched here.

[conviso-platform-appsec]

Conviso Security Gate — No Security Gate rule configured

No conviso_ast rule and no default rule are configured for this asset or company, so there is no policy to evaluate. Nothing was passed or failed.

6 new findings introduced by this pull request: 🔴 6 high

New findings

• 🔴 Detects use of innerHTML with potentially user-controlled data, a critical XSS risk. — src/components/SupportForm/index.js:19
  • Rule: javascript.browser.security.insecure-innerhtml
• 🔴 Detects use of innerHTML, outerHTML, or document.write with potentially user-controlled data, a critical XSS risk. — src/components/SupportForm/index.js:19
  • Rule: javascript.browser.security.insecure-document-method
• 🔴 Detects use of innerHTML with potentially user-controlled data, a critical XSS risk. — src/components/SupportForm/index.js:12
  • Rule: javascript.browser.security.insecure-innerhtml
• 🔴 Detects use of innerHTML, outerHTML, or document.write with potentially user-controlled data, a critical XSS risk. — src/components/SupportForm/index.js:44
  • Rule: javascript.browser.security.insecure-document-method
• 🔴 Detects use of innerHTML, outerHTML, or document.write with potentially user-controlled data, a critical XSS risk. — src/components/SupportForm/index.js:12
  • Rule: javascript.browser.security.insecure-document-method
• 🔴 Detects use of innerHTML with potentially user-controlled data, a critical XSS risk. — src/components/SupportForm/index.js:44
  • Rule: javascript.browser.security.insecure-innerhtml

View the full run in Conviso