[SizzleUnrlsd]

Summary

Syntactic-rules item of #70: five cheap checks in the spirit of dangerous-eval.

• Acceptance tests first (test: define five syntactic rules), implementation follows.
• SymbolCallDetector gains two abilities the new rules need: a subclass that also requires the call graph sees derived call-chain symbols (tarfile.open(p).extractall is tarfile.open.extractall), and an accepts hook keeps only some calls, such as those with a given keyword. Existing detectors are unchanged.
• insecure-tls: verify=False on a Requests or httpx call, or ssl._create_unverified_context(); high severity.
• unsafe-xml: the standard-library and lxml XML parsers, which expand entities; defusedxml is the replacement.
• unsafe-archive-extraction: tarfile and zipfile extraction and shutil.unpack_archive; a tarfile call with a filter keyword is safe.
• insecure-temp-file: tempfile.mktemp.
• weak-random: a random function whose result is assigned to a credential-like name (token, session_id, otp...) or produced by a function named like one; medium confidence, so random.shuffle(cards) stays silent.
• Snapshots: 14 findings appear across the corpus, all read against the code: pygoat's XXE lab (make_parser/parseString on the request body) and its OTP drawn from randint, httpie's verify=False on its update check, luigi's Salesforce responses parsed with ElementTree and its tar extractions, yt-fts's XML parsing of a remote feed. Nothing disappears; 35 bundled plugins, documented in the usage guide.

Part of #70.