FEATURE: Nessus + CIS CAT Converters

[ejohn20]

Creates a new converter + unit tests for Nessus (XML format) and CIS CAT (JSON format) covered in #2531

[yongyan-gh]

@ejohn20 thanks for sharing the sample CisCat/Nessus SARIF files generated by the converters for review. Have couple suggestions pls review.

cc @michaelcfanning

[yongyan-gh]

1. Both converted CisCat and Nessus SARIF files' results don't contain location object in locations property.

GitHub Advanced Security code scanning will not display a result unless it provides a location that specifies the URI of the artifact that contains the result.

If plan to be ingested by GHAS pls consider generate a location for the results.

[yongyan-gh]

2. Considering adding a help URI for each rule through helpUri property of the rule object for both CisCat and Nessus SARIF log if possible.

Providing a URI where users can find detailed information about the rule helps users to understand the result and how they can best address it. The varies SARIF viewers can render a hyperlink for users easily navigate to the Uri contains detailed information.

E.g. the rule id RUSTSEC-2019-0001 has a help Uri 'https://rustsec.org/advisories/RUSTSEC-2019-0001'

[yongyan-gh]

3. Please provide version information through 'version', 'semanticVersion', 'dottedQuadFileVersion' properties of driver object for Nessus SARIF log.

Providing version information enables the log file consumer to determine whether the file was produced by an up to date version, and to avoid accidentally comparing log files produced by different tool versions.

[yongyan-gh]

run.Tool.Driver.Rules.Add(CreateReportDescriptor(rule));

Suggest to only log a rule if its referenced by a result and avoid logging duplicated rules.

This can be done in the results loop below and checking if the rule already exists in the `log.Rules' list.