dotnet: support file/function scope class and namespace features

[mike-hunhoff]

see #1013 for additional context.

we emit both imported and user-defined class/namespace features allowing rules like:

rule:
  meta:
    name: manipulate files using dotnet
    namespace: host-interaction
    author: [email protected]
    scope: file
  features:
    - or:
      - class: System.IO.File

we emit user-defined class/namespace features as this may be useful for writing rules that detect dotnet malware families.

[github-actions]

Please add bug fixes, new features, breaking changes and anything else you think is worthwhile mentioning to the master (unreleased) section of CHANGELOG.md. If no CHANGELOG update is needed add the following to the PR description: [x] No CHANGELOG update needed

CHANGELOG updated or no update needed, thanks! 😄

[mike-hunhoff]

note: if merged we will emit for, e.g. System.IO.File::Exists, the following features:

- namespace: System.IO
- class: System.IO.File
- api: System.IO.File::Exists

[williballenthin]

those features look great!

…

On May 19, 2022, at 1:39 PM, Mike Hunhoff ***@***.***> wrote:  note: if merged we will emit for, e.g. System.IO.File::Exists, the following features: - namespace: System.IO - class: System.IO.File - api: System.IO.File::Exists — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because your review was requested.

[mr-tz]

very cool, I have one suggestion around abstracting namespace, class, method into a class

[mr-tz]

very cool, thanks for the cleanup!

[williballenthin]

this is awesome, thank you!

[williballenthin]

shall we merge @mike-hunhoff
(i'd like to sync my branch with latest changes :-) )

[mike-hunhoff]

@williballenthin yes let's merge!