feat(sast): incremental analysis toggle for gitlab-advanced-sast-ext

What

Add incremental analysis to gitlab-advanced-sast-ext (Swift / Objective-C), on by default, controlled by a single variable, in both the stable and latest SAST templates. The analyzer job's rules: are untouched — the toggle switches the incremental feature only; the job runs either way.

Files

• lib/gitlab/ci/templates/Jobs/SAST.gitlab-ci.yml (stable)
• lib/gitlab/ci/templates/Jobs/SAST.latest.gitlab-ci.yml (latest)

Changes (identical in both)

1. Global variable GITLAB_ADVANCED_SAST_EXT_INCREMENTAL_ENABLED: "true" — the customer-facing toggle, named to match the sibling GITLAB_ADVANCED_SAST_ENABLED. In the global block so a project can override it from its own .gitlab-ci.yml or a project CI/CD variable. Set "false" to force a full scan.
2. cache: on the ext job — carries the SAT store across pipelines (branch-slug key, default-branch fallback).
3. GITLAB_ADVANCED_SAST_EXT_STORE (internal job variable) — points sat at the cached store path.

gitlab-advanced-sast and gitlab-advanced-sast-ext are distinct analyzers; these knobs are -ext-only and namespaced accordingly.

Customer API

Variable	Default	Effect
GITLAB_ADVANCED_SAST_EXT_INCREMENTAL_ENABLED	"true"	Set "false" to force a full scan

Dependencies

https://gitlab.com/gitlab-org/security-products/analyzers/static-analysis-toolkit/-/merge_requests/248+s (sat reads GITLAB_ADVANCED_SAST_EXT_STORE / GITLAB_ADVANCED_SAST_EXT_INCREMENTAL_ENABLED, the latter parsed as a boolean).

https://gitlab.com/gitlab-org/security-products/analyzers/static-analysis-toolkit/-/merge_requests/247+s

E2E

https://gitlab.com/gitlab-org/secure/tests/sat-demo/igoat-swift/-/merge_requests/11+s — one include, real Swift edits: default ON (mode: incremental, 305/306 reused), manual OFF (mode: full, job still runs), and the wall-clock comparison. do not merge.

co-authored-by: claude on claude-sonnet-4-6[1m]