feat(java): detect File.delete/deleteDir on a non-literal path (CWE-22)

[ai-anant]

Summary

Adds a Jenkins/Java rule that flags java.io.File constructed from a non-literal path and then passed to delete() or Groovy deleteDir().

Pattern (generic)

• Source: non-literal string used as new File($PATH) (job config, env expansion, build parameters).
• Sink: $F.delete() / $F.deleteDir() / (new File($PATH)).delete().
• Excludes literal path strings.

This is a different sink than existing non-literal File stream open rules (FileInputStream / FileOutputStream / FileReader / FileBody): the dangerous operation here is deletion (including recursive directory delete), not read/write of file contents.

Why

A caller who can influence the path string can delete arbitrary files or recursively delete directories on the node where the plugin code runs (typically the Jenkins controller) as the service user.

Validation

• semgrep --validate on the new rule: pass
• Positive repro (File f = new File(untrusted); f.delete(); and (new File(p)).delete()): fires
• Negative repro (literal paths only): silent
• Semgrep community java/ ruleset: 0 hits on the positive repro

Notes

Single rule file, branched from current upstream/main.