Make CIS ruleset fixes idempotent, add fix for PR approval dismissal

[timgentry]

What?

Refactors the three fixable CIS ruleset rules (branch deletion denial, force push denial, default branch protection) to share a naming convention and a common fix helper, and adds --fix support to the previously read-only PreviousPrApprovalsDismissed rule.

Why?

Running --fix repeatedly against the same repo used to create a brand new ruleset every time a rule was still failing, rather than updating the one it had already made — leading to duplicate, accumulating rulesets in GitHub over time. A stable per-rule ruleset name lets --fix find and update its own previously-created ruleset instead of piling up copies. PreviousPrApprovalsDismissed was also the last of the four ruleset-based CIS rules with no remediation path, so it always required manual intervention.

How?

Each fixable rule now defines a RULESET_NAME constant (e.g. 'Way of Working CIS: Branch Deletion Denied'). The RulesetFinder concern gained a shared apply_ruleset_fix method that looks for an existing ruleset with that name in the repo's ruleset list — PATCHing it if found, POSTing a new one if not — replacing the three duplicated per-rule apply_fix methods that always created. PreviousPrApprovalsDismissed was updated to follow the same pattern (including RulesetFinder, defining its own required_ruleset_config) instead of only reading rulesets to report failure with no fix.

Testing?

Ran bundle exec rake test (existing suite passes) and bundle exec rubocop on the changed files — no new lint offenses were introduced (the offense count net decreased, since the three duplicated apply_fix methods collapsed into one shared implementation). No dedicated unit tests exist yet for individual rule validate/fix behaviour — that's a pre-existing gap in this repo, not something this PR adds coverage for.

Screenshots (optional)

N/A — no UI changes.

Anything Else?

PreviousPrApprovalsDismissed's fix and DefaultBranchProtection's fix can each create a separate ruleset targeting the default branch's pull_request rule (one enforcing just dismiss_stale_reviews_on_push, the other enforcing several parameters). GitHub merges rules from multiple rulesets on the same branch, so this isn't a conflict — just some ruleset sprawl worth consolidating later if it gets noisy. PublicSecurityFile is now the only rule without --fix, since it needs to write file content via the Contents API rather than a ruleset.

[github-actions]

🦙 MegaLinter status: ❌ ERROR

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	3		0	0	0.02s
⚠️ BASH	bash-exec	1		1	0	0.01s
✅ BASH	shellcheck	1		0	0	0.02s
✅ BASH	shfmt	1		0	0	0.02s
❌ COPYPASTE	jscpd	yes		1	no	1.41s
✅ JSON	jsonlint	1		0	0	0.19s
✅ JSON	v8r	1		0	0	2.23s
⚠️ MARKDOWN	markdownlint	3		1	0	0.64s
❌ MARKDOWN	markdown-link-check	3		1	0	1.95s
✅ MARKDOWN	markdown-table-formatter	3		0	0	0.25s
✅ REPOSITORY	checkov	yes		no	no	21.01s
✅ REPOSITORY	devskim	yes		no	no	1.46s
✅ REPOSITORY	dustilock	yes		no	no	0.01s
✅ REPOSITORY	gitleaks	yes		no	no	0.1s
✅ REPOSITORY	git_diff	yes		no	no	0.0s
❌ REPOSITORY	grype	yes		1	no	23.91s
❌ REPOSITORY	kics	yes		2	no	1.07s
✅ REPOSITORY	secretlint	yes		no	no	0.72s
✅ REPOSITORY	syft	yes		no	no	2.73s
❌ REPOSITORY	trivy	yes		1	no	13.51s
✅ REPOSITORY	trivy-sbom	yes		no	no	2.11s
✅ REPOSITORY	trufflehog	yes		no	no	5.41s
❌ SPELL	lychee	10		4	0	0.59s
✅ YAML	v8r	5		0	0	6.84s
✅ YAML	yamllint	5		0	0	0.37s

See detailed report in MegaLinter reports

You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:

• oxsecurity/megalinter/flavors/terraform@v8.8.0 (55 linters)
• oxsecurity/megalinter/flavors/cupcake@v8.8.0 (88 linters)