feat(rules): add PP001 prototype pollution and INJECT001 code injection detection

[lahin31]

What

Two new critical/high severity rules for the Input Validation category.

PP001 — Prototype Pollution via Object Merge (High)

Detects user-controlled input passed to object merge operations without sanitization:

• Object.assign(target, req.body) — most common vector
• _.merge / lodash.merge / merge / deepMerge / extend(target, req.body)
• obj[req.body.key] = value — computed property assignment with user-controlled key

INJECT001 — Code Injection via eval / new Function (Critical)

Detects user-controlled input passed to dynamic code execution sinks:

• eval(req.body.code)
• new Function(req.body.code) / new Function('x', req.body.expr)
• vm.runInNewContext(req.body.script)
• vm.runInThisContext(req.query.code)
• new vm.Script(req.body.src)

Both rules use the same containsUserInput() pattern as SQL001 — only fire when
user input (req.body, req.query, req.params, req.headers) appears directly
in the dangerous expression. No false positives for hardcoded strings.

Tests

• 18 tests for PP001 (Object.assign, lodash merge, computed assignment — true positives and negatives)
• 14 tests for INJECT001 (eval, new Function, vm module — true positives and negatives)
• 182/182 passing

Docs updated

• docs/rules/README.md — PP001 and INJECT001 added to Input Validation table
• docs/standards.md — OWASP/CWE references for both rules
• docs/false-positives.md — false positive and false negative documentation for both rules
• README.md — Input Validation section, rule table, test count
• CLAUDE.md — rule ID registry, test count