Draft: POC security policy integration with security attributes

What does this MR do and why?

POC security policy integration with security attributes

References

Related to: #589342 (closed)

Screenshots or screen recordings

Before	After

How to set up and validate locally

1. Create a new project
2. Add a .gitlab-ci.yml file with the content:

include:
- template: Jobs/SAST.gitlab-ci.yml

2. Go to Secure > Security Configuration
3. Select Security attributes
4. Click on Edit project security attributes
5. Select Mission Critical
6. Go to Secure > Policies
7. Click on New policy
8. Select Merge request approval policy
9. Create a policy to block new vulnerabilities on Mission Critical projects
10. Get the security_attribute id

category = Security::Category.where(template_type: "business_impact")
Security::Attribute.where(security_category: category).where(name: "Mission Critical").first

11. Create a policy like

approval_policy:
  - name: Test
    description: ''
    enabled: true
    rules:
      - type: scan_finding
        branches: []
        vulnerabilities_allowed: 0
        severity_levels: []
        vulnerability_states: []
        scanners: []
    policy_scope:
      business_impact:
        including:
          - id: 1
    actions:
      - type: require_approval
        approvals_required: <security_attribute_id>
        role_approvers:
          - developer

6. Click on Create new project with the new policy
7. Merge the MR to add the policy
8. Go back to the project created in step 1
9. Create a MR adding the file vuln.rb with the content

class RunScript
  def run_script
    system("cat #{params[:path]}") 
  end
end

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.