CIS-DI-0009 - ADD supports now --checksum

[waja]

Description

CIS-DI-0009 claims the use of ADD, but recent docker versions support --checksum, see https://docs.docker.com/reference/dockerfile/#add---checksum.

[Eljees]

I'd like to work on this. I plan to update the CIS-DI-0009 manifest assessment so an ADD instruction with BuildKit's checksum metadata is not reported, while ordinary ADD instructions remain findings. I'll include focused assessor tests for both paths.

[Eljees]

I reproduced this against current BuildKit before implementing the exemption. Unfortunately, the image metadata available to Dockle cannot distinguish the two cases.

Both Dockerfiles below produced the same image digest and the same CreatedBy history entry:

ADD --checksum=sha256:<digest> http://host.docker.internal/file /payload.txt
ADD http://host.docker.internal/file /payload.txt

ADD http://host.docker.internal/file /payload.txt # buildkit

useADDstatement only receives this history string, so exempting the first form would also exempt the unsafe second form. A reliable fix would require Dockle to additionally consume the Dockerfile or BuildKit provenance (or Docker to preserve the flag in image history). I don't think a manifest-only exemption is safe as things stand.