fix: add security-severity column to CodeQL findings table

Display security-severity score from rule definitions in the CodeQL
findings summary table, providing better visibility when findings
trigger build failures due to high security-severity (>= 7.0).

Author: david-waltermire

.github/workflows/build.yml

@@ -172,9 +172,16 @@ jobs:
                 echo "<details>" >> $GITHUB_STEP_SUMMARY
                 echo "<summary>View $RESULTS finding(s)</summary>" >> $GITHUB_STEP_SUMMARY
                 echo "" >> $GITHUB_STEP_SUMMARY
-                echo "| Severity | Rule | Location | Message |" >> $GITHUB_STEP_SUMMARY
-                echo "|----------|------|----------|---------|" >> $GITHUB_STEP_SUMMARY
-                jq -r '.runs[0].results[] | "| \(.level // "warning") | \(.ruleId // "unknown") | `\(.locations[0].physicalLocation.artifactLocation.uri // "unknown"):\(.locations[0].physicalLocation.region.startLine // "?")` | \(.message.text | gsub("\n"; " ") | gsub("\\|"; "\\\\|") | .[0:80]) |"' "$sarif" >> $GITHUB_STEP_SUMMARY
+                echo "| Level | Security | Rule | Location | Message |" >> $GITHUB_STEP_SUMMARY
+                echo "|-------|----------|------|----------|---------|" >> $GITHUB_STEP_SUMMARY
+                # Join results with rules to get security-severity (which is on rule definitions, not results)
+                jq -r '
+                  (.runs[0].tool.driver.rules // []) as $driver_rules |
+                  ([.runs[0].tool.extensions[]?.rules // []] | add // []) as $ext_rules |
+                  ($driver_rules + $ext_rules | map({(.id): (.properties["security-severity"] // null)}) | add // {}) as $severities |
+                  .runs[0].results[] |
+                  "| \(.level // "warning") | \($severities[.ruleId] // "N/A") | \(.ruleId // "unknown") | `\(.locations[0].physicalLocation.artifactLocation.uri // "unknown"):\(.locations[0].physicalLocation.region.startLine // "?")` | \(.message.text | gsub("\n"; " ") | gsub("\\|"; "\\\\|") | .[0:80]) |"
+                ' "$sarif" >> $GITHUB_STEP_SUMMARY
                 echo "" >> $GITHUB_STEP_SUMMARY
                 echo "</details>" >> $GITHUB_STEP_SUMMARY
               fi