feat: improve source code detection using malware insights on obfuscation

[art1f1c3R]

Summary

Using insights gained from analysis of previous malware samples, some new Semgrep rules are introduced in this PR.

Description of changes

New Execution Methods

It was observed that a method of spawning processes was using the pty module's spawn method. Inline import and sink matches for this have been added.
It was observed that some malware samples would leverage __builtins__ and whether it is a module or a dictionary in the given file. Matching for this as a sink has been added.

Small Pyarmor Update

It was noted in some samples that importing the required Pyarmor execution objects can occur in files like __init__.py, and so can be used in other files without the import. These packages will always be detected, as the import does have to happen, this has just been added to ensure all files utilising Pyarmor are reported.

New Obfuscation Tool Detection - PyHydra

Some observed malware used PyHydra, a python code obfuscation tool. Some common patterns used in the obfuscated code PyHydra produces has been added, along with a cut-down skeleton of what the file looks like in the obfuscation_tools.py samples.

New Decryption

A malware campaign was observed to be using Fernet to encrypt and subsequently decrypt payloads. Matching for this has been added as a sink. The patterns for string construction has also been improved to ensure it can catch uses of list comprehensions and mappings that utilise things like Caesar Ciphers and XOR encryption.

Lambda Functions

It was noted that the lambda functions (like the b64_reversed_decompressed_ioc sample function) were not actually being matched. A pattern-inside match has been added to capture this.

Checklist

• I have reviewed the contribution guide.
• My PR title and commits follow the Conventional Commits convention.
• My commits include the "Signed-off-by" line.
• I have signed my commits following the instructions provided by GitHub. Note that we run GitHub's commit verification tool to check the commit signatures. A green verified label should appear next to all of your commits on GitHub.
• I have updated the relevant documentation, if applicable.
• I have tested my changes and verified they work as expected.