[K9VULN-3872] Add --git-repository option to sbom/sarif upload

[piloulacdog]

TL;DR

Adding --git-repository option support to datadog-ci sbom upload and datadog-ci sarif upload.

What

We have users complaining about CI integration of datadog-ci to generate SBOM for repository which do not report the correct git information.

And why?

Currently, it is not clear how the datadog-ci sbom upload command gets Git context. It currently does:

1. Current process location
2. CI environment variables (can be disabled with: --no-ci-tags option)
3. Override environment variables (DD_GIT_* variables)

Currently users have two options to have the correct Git values when running the upload command from CI:

1. disable ci automatic detection of env vars with--no-ci-tags
2. use override DD_ variables.

The current workaround is to override DD_ variables

export DD_GIT_REPOSITORY_URL=$(git config --get remote.origin.url)
export DD_GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
export DD_GIT_COMMIT_SHA=$COMMIT_SHA
...

it would be better if we could specify a repository while still read CI variables (not related to GIT info). New priority would be:

1. Current process location
2. CI environment variables (can be disabled with: --no-ci-tags option)
3. Explicitly provided Git repository (through --git-repository option)
4. Override environment variables (DD_GIT_* variables)

How?

We give user the ability to pass an extra parameter --git-repository which we will use to initialize the directory from which we read the git environment variables.

Review checklist

• Feature or bugfix MUST have appropriate tests (unit, integration)

[datadog-datadog-prod-us1]

Datadog Report

Branch report: pierrelouis.lacorte/K9VULN-3872-add-git-repository-option
Commit report: 93e3332
Test service: datadog-ci-tests

✅ 0 Failed, 150 Passed, 0 Skipped, 45.67s Total duration (1m 36.88s time saved)

[piloulacdog]

I did create a duplicate "gitconfig" file in sbom/fixtures and sarif/fixtures as I couldn't settle on where to put it in common directory. And it would keep ensuring that those commands have independent test set.
But if you feel strongly another way, please let me know and I would move it.

[piloulacdog]

lucky documentation change, we do support 1.6 too

[piloulacdog]

see: https://github.com/DataDog/datadog-ci/blob/master/src/commands/sbom/validation.ts#L50

[rtrieu]

A few non-breaking suggestions.