Add issues to report with branch filtering

[Copilot]

• Add --branch command-line argument to Context class
• Update Context to use GITHUB_REF environment variable if --branch is not specified
• Update CeTaskResult to include submittedAt, startedAt, and executedAt timestamps
• Create SonarIssue record to represent individual issues
• Update SonarQualityResult to include list of issues
• Add GetIssuesAsync method to SonarQubeClient to fetch issues from API
• Update ToMarkdown in SonarQualityResult to include Issues section
• Add help text for --branch argument in Program.cs
• Add tests for new functionality
• Build and test the changes
• Code review completed and feedback addressed
• Security scan completed (zero vulnerabilities)
• Refactored ServerUrl trimming to happen once during parsing

Summary

Successfully implemented feature to add SonarQube issues to the markdown report:

• Added --branch command-line option (falls back to GITHUB_REF environment variable)
• CeTaskResult captures timestamps (submittedAt, startedAt, executedAt)
• New SonarIssue record stores severity, type, and component path
• Issues fetched via /api/issues/search API with proper URL encoding
• Issues displayed in new table section in markdown report
• ServerUrl trailing slashes trimmed once during parsing (cleaner code)
• All 75 tests pass with zero warnings
• Zero security vulnerabilities detected

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Feature]: Add Issues to report</issue_title>
<issue_description>### Problem Statement

The SonarQualityResult record and Markdown output should contain a list of the issues associated with the scan.

Proposed Solution

Unfortunately SonarQube does not have an API to perform this directly, instead the best option is to use the following REST API "[ServerURL]/api/issues/search?componentKeys=[ProjectKey]&ps=500&issueStatuses=OPEN,CONFIRMED&branch=[branch]&updatedAfter=[DateTime]"

Omitting the branch and updatedAfter may result in including issues associated with other branches or analysis.

To support specifying the branch, a new --branch command-line argument should be introduced; however if unspecified then the github GITHUB_REF environment variable may be used (remembering to strip the "refs/heads/" from the front).

To get the updatedAfter time, it may be appropriate to save more information from the /api/ce/task query - specifically the submittedAt, startedAt, and executedAt timestamps.

The interesting fields from the issues are:

• "severity"
• "type"
• "component" with the component skipping the project key so it's just the file path.

These should be put into a table in a new section of the markdown.

Alternatives Considered

No response

Additional Context

No response

Priority

Medium - Would improve workflow

Contribution

• I would be willing to submit a PR for this feature

Code of Conduct

• I agree to follow this project's Code of Conduct</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Feature]: Add Issues to report #23

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Malcolmnixon]

Rather than doing the TrimEnd everywhere it's used - hows about trimming it when reading the ReportTask information, or even creating a ServerUrlTrimmed property to hide the trimming implementation.

[Copilot]

Moved the trimming to ReportTaskParser.Parse() where the ServerUrl is read. This removes the need for TrimEnd calls throughout SonarQubeClient. Fixed in 23cb814.