feat(sonarqube): title REST API JSON findings with the issue message

[cvas22]

Closes #16115.

Summary

When you import SonarQube REST API JSON (/api/issues/search, /api/hotspots/search, or a zip of those files) as SonarQube Scan, each finding was titled <rule>_<key>, for example typescript:S1533_fjoiewfjoweifjoihugu-. SonarQube API Import titles the same issues with SonarQube's message. This PR makes SonarQube Scan use the message too:

• Bugs, vulnerabilities, code smells and hotspots now take their title from message. A message longer than 511 characters is cut to 507 characters plus ..., the same rule as dojo/tools/api_sonarqube/importer.py.
• If message is empty, the title falls back to <rule>_<key>. rule and key are still in the description, and unique_id_from_tool is unchanged.
• The Soprasteria HTML/JSON paths are not touched.

Effect on existing data

• The title is not in the SonarQube Scan dedup hash (cwe, severity, file_path), and the detailed mode dedups on unique_id_from_tool. So on reimport, existing findings still match, keep their old <rule>_<key> title, and are not duplicated or closed.
• The exception is an instance that has overridden "SonarQube Scan" to the legacy dedup algorithm, which matches on title. There, the first reimport after upgrading re-creates findings with the new title and closes the old ones. The parser docs now say this.

Changes

• dojo/tools/sonarqube/sonarqube_restapi_json.py: new get_title() helper, used for all four finding types.
• unittests/tools/test_sonarqube_parser.py: updated the 9 old title assertions and added test_parse_json_file_issue_16115_title_from_message, which covers a normal message, the empty-message fallback and truncation. It fails without the parser change.
• unittests/scans/sonarqube/issue_16115.json: a small fabricated fixture.
• docs/content/supported_tools/parsers/file/sonarqube.md: a new "Finding Title" section.

[dryrunsecurity]

This pull request modifies sensitive codepaths in dojo/db_migrations and dojo/finding by an author not on the allowed list. These changes are flagged as low severity and are not blocking.

Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/db_migrations/0299_finding_test_numsev_index.py (drs_90b979ce)

Vulnerability	Configured Sensitive Codepath Modified by Non-Allowed Author
Description	File 'dojo/db_migrations/0299_finding_test_numsev_index.py' matches configured sensitive codepath pattern 'dojo/db_migrations/*.py' and was modified by 'cvas22' (commit 23f3ee2) who is not in the allowed authors list.

Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/models.py (drs_5b4143cf)

Vulnerability	Configured Sensitive Codepath Modified by Non-Allowed Author
Description	File 'dojo/finding/models.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by 'cvas22' (commit 23f3ee2) who is not in the allowed authors list.

---

Comment to provide feedback on these findings.

Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]

Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing

All finding details can be found in the DryRun Security Dashboard.