Update shiftleft.yml to add attackable OSS to build rules

[robwlundy]

No description provided.

[github-actions]

Neither source branch nor scan specified; switching to 'single' mode.

Checking analysis of application shiftleft-java-demo against 2 build rules.

Checking findings on scan 18.

Results per rule:

• build-break-rule: FAIL ( 9 matched vulnerabilities; configured threshold is 8)

  First 5 findings:

  ID	Severity	Title
  57	moderate	XSS: Attacker controlled, sensitive data to DB via firstName in CustomerController.debug
  58	moderate	XSS: Attacker controlled, sensitive data to DB via tin in CustomerController.debug
  59	moderate	XSS: Attacker controlled, sensitive data to DB via customer in CustomerController.createCustomer
  60	moderate	XSS: Attacker controlled, sensitive data to DB via socialSecurityNum in CustomerController.debug
  61	moderate	XSS: Attacker controlled, sensitive data to DB via ssn in CustomerController.debug

  Severity	Count
  Critical	0
  Moderate	9
  Info	0

• reachable-oss-vuln: FAIL (44 matched vulnerabilities; configured threshold is 0)

  First 25 findings:

  ID	Severity	Title
  272	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  273	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  274	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  275	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  276	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  277	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  278	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  279	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  280	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  281	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  282	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  283	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  284	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  285	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  286	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  287	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  288	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  289	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  290	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  291	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  292	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  293	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  294	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  295	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11
  296	critical	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.11

  Severity	Count
  Critical	38
  Moderate	6
  Info	0

2 rules failed.