Extend java-owasp and java-find-secbugs modules to support kotlin

[flosell]

Description

This PR introduces Kotlin support using the existing java-owasp and java-find-secbugs modules (both tools support Kotlin projects).

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Toolchain

• Generic
• Java
• JavaScript
• Ruby
• Python
• Other: Kotlin

How Has This Been Tested?

Running dockerized hawkeye against a bare-bones kotlin spring boot project with outdated dependencies:

• Rebuild the Hawkeye Container to get all the tools

  $ docker build -t hawkeye-new .
  

• Get a Kotlin Spring Boot project with vulnerable dependencies and build it

  $ curl https://start.spring.io/starter.tgz \
             -d type=gradle-project \
             -d baseDir=spring-boot-kotlin-gradle \
             -d language=kotlin \
             -d bootVersion=2.0.0.RELEASE | tar -xzvf -
  $ cd spring-boot-kotlin-gradle
  $ ./gradlew build
  

• Run Hawkeye against the project. You should see some findings from find-secbugs about spring boot internals and dependencies with CVEs

  $ docker run --rm -v $PWD:/target hawkeye-new
  

• You can add bug-patterns like a predictable pseudorandom number generator to the code, rebuild and re-scan to prove that application code is also scanned successfully.

Notes for reviewer

I decided to keep the module names as they are (java-find-secbugs, java-owasp) to avoid breaking changes. However, since they support more than one language (I'm guessing they could easily be extended to other JVM languages like Scala or Clojure) this is slightly misleading. Should we rename them to jvm-find-secbugs, jvm-owasp or something like that and if yes, do we need some kind of backwards compatibility? Or should we stick with the pattern "one module - one language" and create separate modules?

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[felixhammerl]

Renaming the modules would be a breaking change. We could think about doing a major version bump. For that we should look into other jvm langs as well, that would sound reasonable.