feat(policies): add fixed_version field to vulnerability finding schema

Add an optional fixed_version string field to PolicyVulnerabilityFinding,
allowing policies to report which version fixes a given vulnerability.
The field is optional and can be set via object.union in Rego policies,
consistent with other optional fields like recommendation and cvss_v3_score.

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

app/controlplane/api/gen/frontend/attestation/v1/crafting_state.ts

@@ -334,6 +334,8 @@ message PolicyVulnerabilityFinding {
   string recommendation = 7;
   // Optional longer description of the vulnerability
   string description = 8;
+  // Version that fixes the vulnerability (e.g., "2.0.1", "1.3.4-patch1")
+  string fixed_version = 9;
 }
 
 // Output schema for SAST findings from policy evaluation.

app/controlplane/api/gen/jsonschema/attestation.v1.PolicyVulnerabilityFinding.jsonschema.json

@@ -60,6 +60,23 @@ result := object.union(
 				"recommendation": "upgrade to v2.0.0",
 			},
 		},
+		{
+			name: "combined with object.union for fixed_version",
+			policy: `package test
+import rego.v1
+
+result := object.union(
+	chainloop.vulnerability("CVE found", "CVE-2024-5678", "pkg:npm/foo@1.0", "HIGH"),
+	{"fixed_version": "1.0.1"},
+)`,
+			expected: map[string]any{
+				"message":       "CVE found",
+				"external_id":   "CVE-2024-5678",
+				"package_purl":  "pkg:npm/foo@1.0",
+				"severity":      "HIGH",
+				"fixed_version": "1.0.1",
+			},
+		},
 		{
 			name: "with sprintf interpolation",
 			policy: `package test

app/controlplane/api/gen/jsonschema/attestation.v1.PolicyVulnerabilityFinding.schema.json

@@ -94,6 +94,27 @@ func TestValidateFinding(t *testing.T) {
 				assert.Equal(t, "A buffer overflow vulnerability in the parsing module allows remote code execution.", f.GetDescription())
 			},
 		},
+		{
+			name:        "valid vulnerability finding with fixed_version",
+			findingType: "VULNERABILITY",
+			raw: map[string]any{
+				"message":       "Found CVE-2024-5678",
+				"external_id":   "CVE-2024-5678",
+				"package_purl":  "pkg:golang/example.com/lib@v1.0.0",
+				"severity":      "HIGH",
+				"fixed_version": "1.0.1",
+			},
+			checkFn: func(t *testing.T, msg interface{}) {
+				t.Helper()
+				f, ok := msg.(*v1.PolicyVulnerabilityFinding)
+				require.True(t, ok)
+				assert.Equal(t, "Found CVE-2024-5678", f.GetMessage())
+				assert.Equal(t, "CVE-2024-5678", f.GetExternalId())
+				assert.Equal(t, "pkg:golang/example.com/lib@v1.0.0", f.GetPackagePurl())
+				assert.Equal(t, "HIGH", f.GetSeverity())
+				assert.Equal(t, "1.0.1", f.GetFixedVersion())
+			},
+		},
 		{
 			name:        "vulnerability finding missing required field",
 			findingType: "VULNERABILITY",