semgrep rule to flag undesirable package imports in adapter code

[onkarvhanumante]

Description

PR adds semgrep rule to flag undesirable package imports in adapter code. Plan here is to run this rule as adapter PR checks. Refer #2907 for more details.

Semgrep uses import metavariable to match package imports - https://semgrep.dev/docs/writing-rules/pattern-syntax/#import-metavariables

Testing

• Sample playground example: https://semgrep.dev/playground/s/QBlo

• Semgrep unit tests passing

   ~ » semgrep --test ./                              
  3/3: ✓ All tests passed
   No tests for fixes found.
  

• Found following instances in repo

   ~ » semgrep --config=./.semgrep/adapter/package-import.yml ./adapters/
  
  
   ┌─────────────┐
   │ Scan Status │
   └─────────────┘
     Scanning 2539 files tracked by git with 1 Code rule:
     Scanning 194 files.
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00
  
  
   ┌─────────────────┐
   │ 5 Code Findings │
   └─────────────────┘
  
       adapters/adapterstest/test_json.go
          semgrep.adapter.package-import-check
             Importing "github.com/mitchellh/copystructure" package is not recommended in adapter code
  
              13┆ "github.com/mitchellh/copystructure"
  
       adapters/adhese/adhese.go
          semgrep.adapter.package-import-check
             Importing "github.com/golang/glog" package is not recommended in adapter code
  
              13┆ "github.com/golang/glog"
  
       adapters/gamoshi/gamoshi.go
          semgrep.adapter.package-import-check
             Importing "github.com/golang/glog" package is not recommended in adapter code
  
               9┆ "github.com/golang/glog"
  
       adapters/pubmatic/pubmatic.go
          semgrep.adapter.package-import-check
             Importing "github.com/golang/glog" package is not recommended in adapter code
  
              13┆ "github.com/golang/glog"
  
       adapters/yeahmobi/yeahmobi.go
          semgrep.adapter.package-import-check
             Importing "github.com/golang/glog" package is not recommended in adapter code
  
              10┆ "github.com/golang/glog"
  
  
  
   ┌──────────────┐
   │ Scan Summary │
   └──────────────┘
   Some files were skipped or only partially analyzed.
     Scan was limited to files tracked by git.
     Scan skipped: 325 files matching .semgrepignore patterns
     For a full list of skipped files, run semgrep with the --verbose flag.
  
   Ran 1 rule on 194 files: 5 findings.
  

[SyntaxNode]

Please use stronger wording. These packages are not allowed / banned. It's more than a recommendation.

[onkarvhanumante]

Apologies. PR got merged. Added #2913 to make this change