Add unit tests for RancherHubConnector and various exporters

- Implemented tests for RancherHubConnector to validate fetching documents, handling errors, and managing state.
- Added tests for CsafExporter to ensure deterministic serialization of CSAF documents.
- Created tests for CycloneDX exporters and reconciler to verify correct handling of VEX claims and output structure.
- Developed OpenVEX exporter tests to confirm the generation of canonical OpenVEX documents and statement merging logic.
- Introduced Rust file caching and license scanning functionality, including a cache key structure and hash computation.
- Added sample Cargo.toml and LICENSE files for testing Rust license scanning functionality.

src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java/Internal/Reflection/JavaReflectionAnalyzer.cs

@@ -241,25 +241,40 @@ internal static class JavaReflectionAnalyzer
                 instructionOffset,
                 null));
         }
-        else if (normalizedOwner == "java/lang/ClassLoader" && (name == "getResource" || name == "getResourceAsStream" || name == "getResources"))
-        {
-            var target = pendingString;
-            var confidence = pendingString is null ? JavaReflectionConfidence.Low : JavaReflectionConfidence.High;
-            edges.Add(new JavaReflectionEdge(
-                normalizedSource,
-                segmentIdentifier,
-                target,
-                JavaReflectionReason.ResourceLookup,
-                confidence,
-                method.Name,
-                method.Descriptor,
-                instructionOffset,
-                null));
-        }
-        else if (normalizedOwner == "java/lang/Thread" && name == "currentThread")
-        {
-            sawCurrentThread = true;
-        }
+        else if (normalizedOwner == "java/lang/ClassLoader" && (name == "getResource" || name == "getResourceAsStream" || name == "getResources"))
+        {
+            var target = pendingString;
+            var confidence = pendingString is null ? JavaReflectionConfidence.Low : JavaReflectionConfidence.High;
+            edges.Add(new JavaReflectionEdge(
+                normalizedSource,
+                segmentIdentifier,
+                target,
+                JavaReflectionReason.ResourceLookup,
+                confidence,
+                method.Name,
+                method.Descriptor,
+                instructionOffset,
+                null));
+        }
+        else if (normalizedOwner == "java/lang/Class" && (name == "getResource" || name == "getResourceAsStream"))
+        {
+            var target = pendingString;
+            var confidence = pendingString is null ? JavaReflectionConfidence.Low : JavaReflectionConfidence.High;
+            edges.Add(new JavaReflectionEdge(
+                normalizedSource,
+                segmentIdentifier,
+                target,
+                JavaReflectionReason.ResourceLookup,
+                confidence,
+                method.Name,
+                method.Descriptor,
+                instructionOffset,
+                null));
+        }
+        else if (normalizedOwner == "java/lang/Thread" && name == "currentThread")
+        {
+            sawCurrentThread = true;
+        }
         else if (normalizedOwner == "java/lang/Thread" && name == "getContextClassLoader")
         {
             if (sawCurrentThread && !emittedTcclWarning)

src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java/TASKS.md

@@ -7,7 +7,7 @@
 | SCANNER-ANALYZERS-JAVA-21-001 | DONE (2025-10-27) | Java Analyzer Guild | SCANNER-CORE-09-501 | Build input normalizer and virtual file system for JAR/WAR/EAR/fat-jar/JMOD/jimage/container roots. Detect packaging type, layered dirs (BOOT-INF/WEB-INF), multi-release overlays, and jlink runtime metadata. | Normalizer walks fixtures without extraction, classifies packaging, selects MR overlays deterministically, records java version + vendor from runtime images. |
 | SCANNER-ANALYZERS-JAVA-21-002 | DONE (2025-10-27) | Java Analyzer Guild | SCANNER-ANALYZERS-JAVA-21-001 | Implement module/classpath builder: JPMS graph parser (`module-info.class`), classpath order rules (fat jar, war, ear), duplicate & split-package detection, package fingerprinting. | Classpath order reproduced for fixtures; module graph serialized; duplicate provider + split-package warnings emitted deterministically. |
 | SCANNER-ANALYZERS-JAVA-21-003 | DONE (2025-10-27) | Java Analyzer Guild | SCANNER-ANALYZERS-JAVA-21-002 | SPI scanner covering META-INF/services, provider selection, and warning generation. Include configurable SPI corpus (JDK, Spring, logging, Jackson, MicroProfile). | SPI tables produced with selected provider + candidates; fixtures show first-wins behaviour; warnings recorded for duplicate providers. |
-| SCANNER-ANALYZERS-JAVA-21-004 | DOING (2025-10-27) | Java Analyzer Guild | SCANNER-ANALYZERS-JAVA-21-002 | Reflection/dynamic loader heuristics: scan constant pools, bytecode sites (Class.forName, loadClass, TCCL usage), resource-based plugin hints, manifest loader hints. Emit edges with reason codes + confidence. | Reflection edges generated for fixtures (classpath, boot, war); includes call site metadata and confidence scoring; TCCL warning emitted where detected. |
+| SCANNER-ANALYZERS-JAVA-21-004 | DONE (2025-10-29) | Java Analyzer Guild | SCANNER-ANALYZERS-JAVA-21-002 | Reflection/dynamic loader heuristics: scan constant pools, bytecode sites (Class.forName, loadClass, TCCL usage), resource-based plugin hints, manifest loader hints. Emit edges with reason codes + confidence. | Reflection edges generated for fixtures (classpath, boot, war); includes call site metadata and confidence scoring; TCCL warning emitted where detected. |
 | SCANNER-ANALYZERS-JAVA-21-005 | TODO | Java Analyzer Guild | SCANNER-ANALYZERS-JAVA-21-002 | Framework config extraction: Spring Boot imports, spring.factories, application properties/yaml, Jakarta web.xml & fragments, JAX-RS/JPA/CDI/JAXB configs, logging files, Graal native-image configs. | Framework fixtures parsed; relevant class FQCNs surfaced with reasons (`config-spring`, `config-jaxrs`, etc.); non-class config ignored; determinism guard passes. |
 | SCANNER-ANALYZERS-JAVA-21-006 | TODO | Java Analyzer Guild | SCANNER-ANALYZERS-JAVA-21-002 | JNI/native hint scanner: detect native methods, System.load/Library literals, bundled native libs, Graal JNI configs; emit `jni-load` edges for native analyzer correlation. | JNI fixtures produce hint edges pointing at embedded libs; metadata includes candidate paths and reason `jni`. |
 | SCANNER-ANALYZERS-JAVA-21-007 | TODO | Java Analyzer Guild | SCANNER-ANALYZERS-JAVA-21-003 | Signature and manifest metadata collector: verify JAR signature structure, capture signers, manifest loader attributes (Main-Class, Agent-Class, Start-Class, Class-Path). | Signed jar fixture reports signer info and structural validation result; manifest metadata attached to entrypoints. |