Add cognium — semantic taint-tracking SAST for Java, JS, TS, Python, Rust, Bash

[coggiyadmin]

Add cognium

**Source:** https://github.com/cogniumhq/cognium
**Homepage:** https://cognium.dev
**License:** MIT

### What it does

Cognium is a semantic SAST engine using taint tracking and a 36-pass analysis pipeline. It detects security vulnerabilities (SQL injection, XSS, SSRF, command injection, path
traversal, and 15 more CWEs) as well as reliability, performance, and maintainability issues. Outputs text, JSON, and SARIF 2.1.0.

### Languages supported

Java, JavaScript, TypeScript, Python, Rust, Bash

### Benchmark scores

| Benchmark | Score |
|-----------|-------|
| OWASP Benchmark | 100% TPR, 0% FPR (1415 test cases) |
| Juliet Test Suite | 100% (156/156, 9 CWEs) |
| SecuriBench Micro | 97.7% TPR |

### Checklist

- [x] Tool is actively maintained
- [x] MIT licensed
- [x] CLI interface
- [x] `make render` passes locally