rule tuning: make severities more appropriate

[tstromberg]

risk tuning, mostly relating to "HIGH" findings in Wolfi.

Add/fix testdata missing for clean Linux files.

[egibs]

Nice!

Would you mind looking at wolfi-dev/os#30457?

The gitaly binary is 252MB and 66MB after being compressed which is still pretty large.

Would it make sense to tune the linux_multi_persist rule to high or just add a quick override rule for that binary?

[tstromberg]

Would you mind looking at wolfi-dev/os#30457?

gitaly looks interesting.

Would it make sense to tune the linux_multi_persist rule to high or just add a quick override rule for that binary?

For now, I think the rule should hit rare enough that we should do overrides; assuming the binary we are looking at isn't doing anything bad.

[egibs]

gitaly looks interesting.

Indeed. AFAIK none of the previous releases triggered that rule.

Update -- investigation is here: wolfi-dev/os#30457 (comment)

I'll open a PR for an override rule.