Route Rust (.rs) files to gitlab-advanced-sast-ext

SAST template routing — Rust (.rs) → gitlab-advanced-sast-ext

Adds Rust to gitlab-advanced-sast-ext the same way Dart/Scala were added in Add Dart and Scala support to gitlab-advanced-s... (!253346 - merged) • Hua Yan • 19.4, across all five touchpoints (links point at the exact lines on this MR's branch):

• lib/gitlab/ci/templates/Jobs/SAST.gitlab-ci.yml — - '**/*.rs' in the gitlab-advanced-sast-ext exists rule (extension glob, consistent with .swift/.m/.mm).
• lib/gitlab/ci/templates/Jobs/SAST.latest.gitlab-ci.yml — same, in the latest template.
• ee/spec/lib/gitlab/ci/templates/sast_gitlab_ci_yaml_spec.rb and sast_latest_gitlab_ci_yaml_spec.rb — 'Rust with advanced SAST ext' | ['app.rs'] | {GITLAB_ADVANCED_SAST_ENABLED=>true} | %w[gitlab-advanced-sast-ext] (semgrep-sast has no .rs glob, so it does not run — like Dart / Objective-C++).
• doc/user/application_security/sast/gitlab_advanced_sast.md — Rust (beta) in the supported-language list, a history entry, the beta note, and the variable descriptions (GITLAB_ADVANCED_SAST_ENABLED, GITLAB_ADVANCED_SAST_EXT_INCREMENTAL_ENABLED).
• doc/user/application_security/sast/_index.md — replace the outdated Scan a Rust application custom-ruleset example with Scan an OCaml application, since Rust is now scanned natively by GitLab Advanced SAST while OCaml is Semgrep-supported but not covered by any GitLab Advanced SAST analyzer. Rust is not added to the language comparison tables (the standard analyzer ships no GitLab-managed Rust rules).

Verification (customer-style)

The demo project is a Rust app. Its .gitlab-ci.yml is a single include: of this MR's template branch plus GITLAB_ADVANCED_SAST_ENABLED: 'true' (no custom jobs or scripts). Acceptance criterion: the template starts the gitlab-advanced-sast-ext job for the Rust repository. The job started and completed successfully, pulling the released image registry.gitlab.com/security-products/gitlab-advanced-sast-ext:0 (digest sha256:8a0d07e3…, analyzer v0.74.1, the first :0 tag with the Rust front-end). No project-level image override is in effect, so this is the actual customer path. semgrep-sast correctly did not start (.rs is not in its exist-rules).

Language	Demo project	Verification MR	MR pipeline	gitlab-advanced-sast-ext job
Rust	gitlab-org/secure/tests/hyan/rust-vuln-demo	https://gitlab.com/gitlab-org/secure/tests/hyan/rust-vuln-demo/-/merge_requests/3	https://gitlab.com/gitlab-org/secure/tests/hyan/rust-vuln-demo/-/pipelines/2867386038	https://gitlab.com/gitlab-org/secure/tests/hyan/rust-vuln-demo/-/jobs/16624968022 (success)

The verification .gitlab-ci.yml:

include:
  - remote: 'https://gitlab.com/gitlab-org/gitlab/-/raw/hua/sast-rust-routing/lib/gitlab/ci/templates/Jobs/SAST.gitlab-ci.yml'

variables:
  GITLAB_ADVANCED_SAST_ENABLED: 'true'
  AST_ENABLE_MR_PIPELINES: 'true'

Rust SAST support — stacked MRs (cross-linked)

Tracking issue: https://gitlab.com/gitlab-org/gitlab/-/work_items/627510 · Epic: https://gitlab.com/groups/gitlab-org/-/epics/21952

• MR1 · Design (docs/rust-support/DESIGN.md): https://gitlab.com/gitlab-org/security-products/analyzers/static-analysis-toolkit/-/merge_requests/329+s
• MR2 · Front-end (Language::Rust + lang/rust.rs): https://gitlab.com/gitlab-org/security-products/analyzers/static-analysis-toolkit/-/merge_requests/330+s
• MR3 · Taint patterns (mainstream frameworks/libs): https://gitlab.com/gitlab-org/security-products/analyzers/static-analysis-toolkit/-/merge_requests/331+s
• MR4 · Library summaries + lib type summariser (10 libs): https://gitlab.com/gitlab-org/security-products/analyzers/static-analysis-toolkit/-/merge_requests/332+s
• → MR5 · SAST template routes .rs (gitlab-org/gitlab) (this MR): Route Rust (.rs) files to gitlab-advanced-sast-ext (!253352 - merged) • Hua Yan • 19.5

E2E (real MRs, Security-tab verified, latest):

• vuln demo — 17 findings (cmd 5, sqli 5, ssrf 3, path 4), 0 FP: https://gitlab.com/gitlab-org/secure/tests/hyan/rust-vuln-demo/-/merge_requests/1 · job https://gitlab.com/gitlab-org/secure/tests/hyan/rust-vuln-demo/-/jobs/16273535357
• ripgrep popular — 1 TP, 0 FP on real code: https://gitlab.com/gitlab-org/secure/tests/hyan/popular-rg-rust-e2e/-/merge_requests/1 · job https://gitlab.com/gitlab-org/secure/tests/hyan/popular-rg-rust-e2e/-/jobs/16273535640
• fd popular — 1 TP, 0 FP on real code: https://gitlab.com/gitlab-org/secure/tests/hyan/popular-fd-rust-e2e/-/merge_requests/1 · job https://gitlab.com/gitlab-org/secure/tests/hyan/popular-fd-rust-e2e/-/jobs/16273536016

Unit-test CI (green, latest): MR1 pipeline/test · MR2 pipeline/test · MR3 pipeline/test

co-authored-by: claude on claude-opus-4-8[1m]