pghistory: add context for each process and celery tasks

[valentijnscholten]

Adds context to each high level process, i.e. import, reimport, async_dedupe_delete, etc.
Context now looks like this:

{
  "url": "/engagement/91/import_scan_results",
  "user": 1,
  "source": "import",
  "scan_type": "Acunetix Scan",
  "remote_addr": "10.250.1.1"
}

With pghistory you cannot nest contexts. If you nest them, they will just get merged. Data in the "child" context will overwrite data in the existing ("parent") context. This means we cannot set context data for "subprocesses" like close_old_findings or deduplication. We only set the context at the UI/API/COMMAND entrypoints with a source field.

This PR also propagates pghistory contexts to celery tasks. This will have all async tasks during import grouped under one import context instead of no context.

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request includes sensitive edits to dojo/api_v2/views.py and introduces a potential IDOR in dojo/finding/views.py where finding_bulk_update_all filters Finding by user-supplied IDs without scoping to the authenticated user's permitted findings, allowing unauthorized access or modification of other users' findings.

🔴 Configured Codepaths Edit in dojo/api_v2/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🟡 Potential IDOR Vulnerability in dojo/finding/views.py

Vulnerability

Potential IDOR Vulnerability

Description

The function finding_bulk_update_all retrieves Finding objects using user-supplied IDs from request.POST.getlist("finding_to_update") via Finding.objects.filter(id__in=finding_to_update). This query is not scoped to the authenticated user's authorized findings (e.g., via ownership or product permissions), allowing a low-privilege user to fetch and potentially modify findings belonging to products they do not have access to, thus creating an Insecure Direct Object Reference (IDOR) vulnerability.

django-DefectDojo/dojo/finding/views.py

Lines 2566 to 2568 in a22093e

	finds = Finding.objects.filter(id__in=finding_to_update).order_by("id")
	total_find_count = finds.count()
	prods = set(find.test.engagement.product for find in finds) # noqa: C401

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved