feat(asm): cmdi patch refactor + rasp support

[christophe-papazian]

• Add suport for CMDI for Exploit Prevention on subprocess module and system.spawn* functions
• Increase support for SHI for Exploit Prevention on subprocess module (with shell=True)
• Refactor patching process for subprocess and os related to those functions. Use only one patching process for both asm attacks and IAST.
• Update Codeowners file
• Add Exploit Prevention unit tests for CMDI on all supported frameworks
• Add rule_variant tags for exploit prevention telemetry

once merged this will also be tested with DataDog/system-tests#3791

APPSEC-56275

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

[github-actions]

CODEOWNERS have been resolved as:

releasenotes/notes/rasp_cmdi-3c7819ee9e33e447.yaml                      @DataDog/apm-python
.github/CODEOWNERS                                                      @DataDog/python-guild @DataDog/apm-core-python
ddtrace/appsec/_capabilities.py                                         @DataDog/asm-python
ddtrace/appsec/_common_module_patches.py                                @DataDog/asm-python
ddtrace/appsec/_constants.py                                            @DataDog/asm-python
ddtrace/appsec/_iast/_pytest_plugin.py                                  @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/command_injection.py                   @DataDog/asm-python
ddtrace/appsec/_metrics.py                                              @DataDog/asm-python
ddtrace/appsec/_processor.py                                            @DataDog/asm-python
ddtrace/contrib/internal/subprocess/patch.py                            @DataDog/asm-python
tests/appsec/appsec/rules-rasp-blocking.json                            @DataDog/asm-python
tests/appsec/appsec/rules-rasp-disabled.json                            @DataDog/asm-python
tests/appsec/appsec/rules-rasp-redirecting.json                         @DataDog/asm-python
tests/appsec/appsec/rules-rasp.json                                     @DataDog/asm-python
tests/appsec/appsec/test_remoteconfiguration.py                         @DataDog/asm-python
tests/appsec/contrib_appsec/django_app/urls.py                          @DataDog/asm-python
tests/appsec/contrib_appsec/fastapi_app/app.py                          @DataDog/asm-python
tests/appsec/contrib_appsec/flask_app/app.py                            @DataDog/asm-python
tests/appsec/contrib_appsec/utils.py                                    @DataDog/asm-python
tests/appsec/iast/taint_sinks/test_command_injection.py                 @DataDog/asm-python

[datadog-dd-trace-py-rkomorn]

Datadog Report

Branch report: christophe-papazian/cmdi_support
Commit report: 1e3c3bf
Test service: dd-trace-py

✅ 0 Failed, 87 Passed, 1468 Skipped, 3m 56.06s Total duration (35m 33.79s time saved)

[pr-commenter]

Benchmarks

Benchmark execution time: 2025-01-09 14:27:42

Comparing candidate commit 1e3c3bf in PR branch christophe-papazian/cmdi_support with baseline commit 75bed24 in branch main.

Found 0 performance improvements and 3 performance regressions! Performance is the same for 391 metrics, 2 unstable metrics.

scenario:iast_aspects-ospathdirname_aspect

• 🟥 execution_time [+381.039ns; +444.966ns] or [+10.348%; +12.084%]

scenario:iast_aspects-ospathjoin_aspect

• 🟥 execution_time [+385.215ns; +445.063ns] or [+7.361%; +8.505%]

scenario:iast_aspects-ospathsplitext_aspect

• 🟥 execution_time [+330.747ns; +387.286ns] or [+9.116%; +10.674%]

[gnufede]

Great work!