Support parsing: VS Code extension metadata

[mstykow]

Local scancode-rust tracking issue for VS Code extension metadata as an npm-family package surface.

Related upstream issue: aboutcode-org/scancode-toolkit#4833

[mstykow]

Cross-reference: upstream has a second, broader issue — aboutcode-org/scancode-toolkit#5124 ("Parse manifest of VSCode extensions and OpenVSX").

This tracking issue currently mirrors aboutcode-org/scancode-toolkit#4833, which frames VSCode extensions as likely just npm-family enrichment via package.json (lower priority). #5124 explicitly widens the ask:

• also cover OpenVSX publishing metadata, and
• look for VSCode-specific extension metadata in addition to package.json (e.g. the extension.vsixmanifest XML in a packaged .vsix, publisher/engines fields).

So #5124 is not fully represented by the npm-enrichment framing here — if/when we pick this up, scope should include the dedicated .vsixmanifest surface and OpenVSX, not just package.json fields.

[mstykow]

Status update: the .vsixmanifest slice landed in #1237 (plus follow-ups #1239, #1240).

Done

• Dedicated parsing of extracted extension.vsixmanifest metadata as a first-class VS Code extension surface (not just npm-family package.json enrichment), per the maintainer note above. Emits pkg:vscode-extension/<publisher>/<id> with version, TargetPlatform platform qualifier, publisher party, keywords/categories, and marketplace/source/support/homepage URLs + engine constraint recovered from <Properties>. Wired through scanner registration, OnePerPackageData assembly, supported-format docs, and parser/scan/golden tests.
• A benchmark-backed verification on real extracted extensions (Open VSX: prettier 11.0.0, vscode-yaml 1.14.0, ms-python.python 2024.0.1) is recorded in docs/BENCHMARKS.md (perf(license): re-land referenced-filename tokenization memoization + VSIX benchmark (#1238) #1239).
• Two general engine fixes surfaced by that verification also landed: a quadratic license-detection hot path on minified bundles (perf(license): re-land referenced-filename tokenization memoization + VSIX benchmark (#1238) #1239) and a prose-context pruning misfire that dropped genuine short license references on minified long lines (fix(license): don't apply prose-context pruning to minified long lines #1240).

Still open (why this issue stays open)

This issue tracks the broader ask from upstream aboutcode-org/scancode-toolkit#5124, which is only partially covered:

• OpenVSX publishing metadata — not yet parsed.
• package.json-based enrichment for VS Code extensions (engines/publisher/etc. from the npm manifest) — intentionally deferred in feat(vscode-extension): parse VSIX manifest metadata #1237.

Leaving this open as the umbrella for the remaining OpenVSX + package.json-enrichment scope.