Missing context new status for CA

[barv-jfrog]

• The pull request is targeting the dev branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

---

Description:
New status in contextual analysis - missing context. If a CVE gets a missing context under contextual analysis this means that this CVE exists on binary but not on source code. (For example a scanner exists but is of type ELF, YAML, etc - not source code). This helps to distinguish between Not covered which means this CVE doesn't have a jfrog scanner at all to Missing context which means the CVE is covered but not on source code.

Since missing context doesn't mean Not applicable it has a higher priority. Also its not that its not Covered, just not covered in source code, which in conclusion we believe deserves a higher priority than Not covered as well.

Additional description:
Jfrog research team work on many CVEs using scanners they create. These scanners have a type, like JS, JAVASRC, YAML, etc..
When using jf audit we scan for src code, and therefore the scanners which can be run on the relevant project are only scanners of source code types which are being supported by the CLI (JAVASRC, JS, Python, NuGet soon and more) but not on scanners that are of type YAML, text, binary, elf, etc, however, these CVEs are supported on binary scanning on xray platform - So we want to distinguish between those CVEs that are not covered at all (no scanner) and those that are covered on xray platform but not on source code scanning (jf audit).

This CA status is only for jf audit.

[hadarshjfrog]

1. Could you please add a bit more info the PR description. Maybe an example of when will a CVE will be found in a Binary but not in source? Is it a result that'll be relevant only for audit? or also for (docker) scan?

2. Please add relevant results to SARIFs in: tests/testdata/other/applicability-scan.
   Also - can you add a project that will return such results when being scan?

[attiasas]

Check out my comments. Also. add to integration tests the status. (validation + issue with the status)
Like in the validation methods: VerifySimpleJsonJasResults

[attiasas]

Please only include the needed dependency for the test to reduce size and test times

[github-actions]

---

🐸 JFrog Frogbot