COR-1641: CLI-02: Scan-Level Metadata Tagging

[leenk7991]

• related doghouse PR: https://github.com/Corgea/doghouse/pull/1680

Summary

Add repeatable --metadata KEY=VALUE on corgea scan so CI can tag a blast scan; the CLI sends it as a JSON metadata multipart part on upload.

Changes

• src/main.rs
  • New --metadata KEY=VALUE (repeatable, blast-only)
  • Validate before packaging
  • Incompatible with --skip-if-scanned (same rule as --policy / --scan-type / …)
• src/scanners/blast.rs
  • metadata_json_from_pairs: parse pairs → JSON object string (= split on first occurrence; duplicate keys last-wins)
  • Thread Option<String> into upload
  • Unit tests for parser behavior
• src/utils/api.rs
  • upload_zip(..., metadata: Option<String>) — add metadata multipart part when present
  • ScanResponse.metadata for corgea list --json parity

Notes

• Stacked on CLI-01 (cor-1639-scan-sha-tracking); retarget base to main after COR-1639: CLI-01: Scan Optimization (SHA Tracking) #123 merges.
• Requires matching doghouse support for the metadata multipart field.

Screenshots

1. invalid metadata

---

---

2. running a scan with metadata

---

---

---

3. running a scan without metadata

---

---

[Ibrahimrahhal]

What is the use case for this? why do we need to store these tags

[yhoztak]

LGTM

[leenk7991]

What is the use case for this? why do we need to store these tags

i think it's one of the requirements from the meeting with TransUnion: https://linear.app/corgea/issue/COR-1641/cli-02-scan-level-metadata-tagging

[juangaitanv]

lgtm