Add rule use-of-basic-authentication (OpenAPI Spec) (#3370)

* Add rule use-of-basic-authentication (OpenAPI)

* Update: Restricted to version 3. Version 2 uses 'securityDefinitions' instead of 'components/securitySchemes'

---------

Co-authored-by: Vasilii Ermilov <inkz@xakep.ru>

yaml/openapi/security/use-of-basic-authentication.test.yaml

@@ -0,0 +1,36 @@
+openapi: 3.1.0
+info:
+  title: Example API
+  description: Example API
+  version: 1.0.0
+
+servers:
+  - url: https://api.example.com/
+
+paths:
+  /test/{param}:
+    get:
+      operationId: test
+      parameters:
+        - name: param
+          in: path
+          required: true
+          description: test
+          schema:
+            type: string
+
+security:
+  - basicAuth: []
+  - apiKeyAuth: []
+
+components:
+  securitySchemes:
+    basicAuth:
+      # ruleid: use-of-basic-authentication
+      type: http
+      scheme: basic
+    apiKeyAuth:
+      # ok: use-of-basic-authentication
+      type: apiKey
+      in: header
+      name: X-API-Key

yaml/openapi/security/use-of-basic-authentication.yaml

@@ -0,0 +1,41 @@
+rules:
+  - id: use-of-basic-authentication
+    languages: [yaml]
+    message: >-
+      Basic authentication is considered weak and should be avoided. 
+      Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS.
+    severity: ERROR
+    patterns:
+      - pattern-inside: |
+          openapi: $VERSION
+          ...
+          components:
+            ...
+            securitySchemes:
+              ...
+              $SCHEME:
+                ...
+      - metavariable-regex:
+          metavariable: $VERSION
+          regex: 3.*
+      - pattern: |
+          type: http
+          ...
+          scheme: basic
+    metadata:
+      category: security
+      subcategory: vuln
+      technology: 
+        - openapi
+      likelihood: MEDIUM
+      impact: HIGH
+      confidence: HIGH
+      cwe: 'CWE-287: Improper Authentication'
+      owasp: 
+        - 'A04:2021 Insecure Design'
+        - 'A07:2021 Identification and Authentication Failures'
+      references:
+        - https://cwe.mitre.org/data/definitions/287.html
+        - https://owasp.org/Top10/A04_2021-Insecure_Design/
+        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
+