fix: address CodeRabbit nitpicks

- Replace ADD with COPY in Dockerfile.local (Docker best practice)
- Add security-severity column to CodeQL findings table for better
  visibility when findings trigger build failures

Author: david-waltermire

.github/workflows/build.yml

@@ -171,9 +171,16 @@ jobs:
                 echo "<details>" >> $GITHUB_STEP_SUMMARY
                 echo "<summary>View $RESULTS finding(s)</summary>" >> $GITHUB_STEP_SUMMARY
                 echo "" >> $GITHUB_STEP_SUMMARY
-                echo "| Severity | Rule | Location | Message |" >> $GITHUB_STEP_SUMMARY
-                echo "|----------|------|----------|---------|" >> $GITHUB_STEP_SUMMARY
-                jq -r '.runs[0].results[] | "| \(.level // "warning") | \(.ruleId // "unknown") | `\(.locations[0].physicalLocation.artifactLocation.uri // "unknown"):\(.locations[0].physicalLocation.region.startLine // "?")` | \(.message.text | gsub("\n"; " ") | gsub("\\|"; "\\\\|") | .[0:80]) |"' "$sarif" >> $GITHUB_STEP_SUMMARY
+                echo "| Level | Security | Rule | Location | Message |" >> $GITHUB_STEP_SUMMARY
+                echo "|-------|----------|------|----------|---------|" >> $GITHUB_STEP_SUMMARY
+                # Join results with rules to get security-severity (which is on rule definitions, not results)
+                jq -r '
+                  (.runs[0].tool.driver.rules // []) as $driver_rules |
+                  ([.runs[0].tool.extensions[]?.rules // []] | add // []) as $ext_rules |
+                  ($driver_rules + $ext_rules | map({(.id): (.properties["security-severity"] // null)}) | add // {}) as $severities |
+                  .runs[0].results[] |
+                  "| \(.level // "warning") | \($severities[.ruleId] // "N/A") | \(.ruleId // "unknown") | `\(.locations[0].physicalLocation.artifactLocation.uri // "unknown"):\(.locations[0].physicalLocation.region.startLine // "?")` | \(.message.text | gsub("\n"; " ") | gsub("\\|"; "\\\\|") | .[0:80]) |"
+                ' "$sarif" >> $GITHUB_STEP_SUMMARY
                 echo "" >> $GITHUB_STEP_SUMMARY
                 echo "</details>" >> $GITHUB_STEP_SUMMARY
               fi

Dockerfile.local

@@ -9,8 +9,7 @@ FROM ${BUILDER_IMAGE} AS builder
 ARG BUILDER_JDK_VENDOR=temurin
 ARG BUILDER_JDK_MAJOR_VERSION=17
 ARG BUILDER_JDK_HOME_PATH=/opt/java/openjdk
-# trivy:ignore:DS005 - ADD used intentionally to copy entire build context
-ADD . /usr/local/src
+COPY . /usr/local/src
 WORKDIR /usr/local/src
 # trivy:ignore:DS029
 RUN apt-get update && apt-get install -y unzip