ascanrules: Reduce SQL Injection boolean-based false positives

[Karl-Seryani]

Summary

• Adds a control request to the boolean-based SQL injection detection to verify page stability before raising alerts
• After AND FALSE (or OR TRUE) differs from baseline, the scan re-sends the original parameter value as a control check
• If the control response also differs from baseline, the page is considered unstable and the alert is raised at CONFIDENCE_LOW instead of CONFIDENCE_MEDIUM
• Applied consistently at all 3 boolean-based alert sites: AND FALSE path, OR TRUE fallback path, and the no-data path

Fixes zaproxy/zaproxy#9289

Context

The boolean-based checks currently do two requests: AND TRUE (should match original) and AND FALSE (should differ). This can false-positive when the page has dynamic content (CSRF tokens, timestamps, view counters) that changes between requests. The expression-based check already has proper confirmation, so this applies a similar pattern to the boolean-based paths.

Rather than suppressing alerts entirely when instability is detected, the fix degrades confidence to LOW so the finding is still surfaced for manual verification.

Test plan

• shouldAlertWithLowConfidenceIfControlRequestShowsPageIsUnstable - AND FALSE path with unstable page
• shouldAlertIfControlConfirmsStablePage - stable page still alerts at MEDIUM
• shouldNotAlertIfNumericParameterStripsNonNumericInput - regression test for #9289
• shouldAlertWithLowConfidenceIfOrTrueControlRequestShowsPageIsUnstable - OR TRUE path with unstable page
• shouldAlertWithLowConfidenceIfNoDataControlRequestShowsPageIsUnstable - no-data path with unstable page
• All existing tests pass
• ./gradlew :addOns:ascanrules:check passes

[psiinon]

Checkmarx One – Scan Summary & Details – a59c33cf-3b12-4628-aad6-65cd9395bba3

Great job! No new security vulnerabilities introduced in this pull request

---

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

[Karl-Seryani]

Updated to extract the duplicated control check logic into a checkPageStability() helper method. The AND FALSE and OR TRUE paths now share the same method. The no-data path stays inline since it uses string comparison instead of compareResponses().