Add structured findings to webhook payload

[dc-larsen]

Summary

• Each connector's webhook formatter now builds a findings array of structured objects alongside the markdown table
• WebhookNotifier payload includes timestamp (ISO 8601), scan_type, summary (severity counts), and findings
• Backward compatible: notification.content (markdown) still present
• TruffleHog findings intentionally omit redacted secret values from structured output

New payload shape

{
  "repository": "...",
  "branch": "...",
  "scanner": "socket-security",
  "timestamp": "2026-02-27T19:49:33Z",
  "scan_type": "Socket CVE Scanning Results: Dockerfile",
  "summary": {"total": 71, "critical": 9, "high": 22, "medium": 12, "low": 10},
  "findings": [
    {"package": "bson", "version": "1.0.9", "ecosystem": "npm", "purl": "pkg:npm/bson@1.0.9", "cves": ["CVE-2020-7610"], "severity": "critical", "scanner": "trivy"}
  ],
  "notification": {"title": "...", "content": "markdown table..."}
}

Test plan

• 125 tests pass (all existing + 25 new)
• Push to dc-larsen/socket-basics-test, trigger workflow, verify payload on webhook.site
• Confirm findings are structured JSON with proper ecosystems (no pkg:unknown/)

[lelia]

LGTM - as discussed, we've converged on the plural cves list to be used within the findings object, rather than have Trivy and Socket Tier 1 diverge.

@dc-larsen for posterity, here are some examples of what the new JSON output may look like in webhook form:

Basic example with cves:

{
  "repository": "demo/repo",
  "branch": "main",
  "scanner": "socket-security",
  "timestamp": "2026-03-03T00:35:19Z",
  "scan_type": "Socket CVE Scanning Results: Dockerfile",
  "summary": {
    "total": 1,
    "critical": 1,
    "high": 0,
    "medium": 0,
    "low": 0
  },
  "findings": [
    {
      "package": "bson",
      "version": "1.0.9",
      "ecosystem": "npm",
      "purl": "pkg:npm/bson@1.0.9",
      "cves": [
        "CVE-2020-7610"
      ],
      "severity": "critical",
      "scanner": "trivy"
    }
  ],
  "notification": {
    "title": "Socket CVE Scanning Results: Dockerfile",
    "content": "| a | b |\\n|---|---|\\n| x | y |"
  }
}

Representative SAST example:

{
  "repository": "local/app-tests-python",
  "branch": "local-test",
  "scanner": "socket-security",
  "timestamp": "2026-03-03T00:54:31Z",
  "scan_type": "SAST Python",
  "summary": {
    "total": 6,
    "critical": 5,
    "high": 1,
    "medium": 0,
    "low": 0
  },
  "findings": [
    {
      "rule": "python-command-injection",
      "severity": "critical",
      "file": "vulnerable_app.py",
      "path": "workspace/app_tests/python/vulnerable_app.py",
      "lines": "8-8",
      "language": "sast-python",
      "scanner": "opengrep"
    },
    {
      "rule": "python-start-process-with-shell",
      "severity": "critical",
      "file": "vulnerable_app.py",
      "path": "workspace/app_tests/python/vulnerable_app.py",
      "lines": "8-8",
      "language": "sast-python",
      "scanner": "opengrep"
    },
    {
      "rule": "python-subprocess-shell-true",
      "severity": "critical",
      "file": "vulnerable_app.py",
      "path": "workspace/app_tests/python/vulnerable_app.py",
      "lines": "8-8",
      "language": "sast-python",
      "scanner": "opengrep"
    },
    {
      "rule": "python-hardcoded-secret",
      "severity": "high",
      "file": "vulnerable_app.py",
      "path": "workspace/app_tests/python/vulnerable_app.py",
      "lines": "10-10",
      "language": "sast-python",
      "scanner": "opengrep"
    },
    {
      "rule": "python-pickle-usage",
      "severity": "critical",
      "file": "vulnerable_app.py",
      "path": "workspace/app_tests/python/vulnerable_app.py",
      "lines": "19-19",
      "language": "sast-python",
      "scanner": "opengrep"
    },
    {
      "rule": "python-unsafe-deserialization",
      "severity": "critical",
      "file": "vulnerable_app.py",
      "path": "workspace/app_tests/python/vulnerable_app.py",
      "lines": "19-19",
      "language": "sast-python",
      "scanner": "opengrep"
    }
  ],
  "notification": {
    "title": "SAST Python",
    "content": "Rule | Severity | File | Path | Lines | Code | SubType | Scanner\n--- | --- | --- | --- | --- | --- | --- | ---\npython-command-injection | critical | vulnerable_app.py | workspace/app_tests/python/vulnerable_app.py | 8-8 | os.system(user_input)  # Command injection vulnerability | sast-python | opengrep\npython-start-process-with-shell | critical | vulnerable_app.py | workspace/app_tests/python/vulnerable_app.py | 8-8 | os.system(user_input)  # Command injection vulnerability | sast-python | opengrep\npython-subprocess-shell-true | critical | vulnerable_app.py | workspace/app_tests/python/vulnerable_app.py | 8-8 | os.system(user_input)  # Command injection vulnerability | sast-python | opengrep\npython-hardcoded-secret | high | vulnerable_app.py | workspace/app_tests/python/vulnerable_app.py | 10-10 | password = \"hardcoded_password\"  # Hardcoded secret | sast-python | opengrep\npython-pickle-usage | critical | vulnerable_app.py | workspace/app_tests/python/vulnerable_app.py | 19-19 | data = pickle.loads(open(\"user_data.pkl\", \"rb\").read())  # Unsafe deserialization | sast-python | opengrep\npython-unsafe-deserialization | critical | vulnerable_app.py | workspace/app_tests/python/vulnerable_app.py | 19-19 | data = pickle.loads(open(\"user_data.pkl\", \"rb\").read())  # Unsafe deserialization | sast-python | opengrep"
  }
}