Semgrep: Fortran (free-form) Support

[dev-zero]

Since there's some new development around Fortran (see the https://fortran-lang.org/ efforts), Fortran support would be nice since the standard deprecated some patterns and there are some anti-patterns as well which could be caught by a project like this.

Restricting it to free-form Fortran might be a good idea to limit the complexity of it.

[ievans]

@dev-zero thanks for the comment! Under the hood, we're using tree-sitter for new grammars. I found https://github.com/stadelmanma/tree-sitter-fortran but I'm not sure how complete the project is in terms of parse rate success (perhaps you could ask @stadelmanma?)

If there is a complete tree-sitter grammar, the integration work is a fairly straightforward O'Caml transformation from the Fortran AST to the semgrep generic AST.

[stadelmanma]

@ievans and @dev-zero I haven't touched the code in awhile since my need for a AST parser for Fortran went away (which is sad, because I loved working with Fortran). I _think_ it was somewhere in the neighborhood of 70% complete and I'm pretty sure everything in the test corpus was successfully parsed.

The major barrier to me getting it all done back in the day were, one that I had (and other than this attempt still have) zero experience with parsing code into an AST. Two, Fortran turned out to be surprisingly hard to parse in a "context free way" since several aspects of the language are context sensitive at least as I understand the term. The language reuses characters and expressions and their meaning depends on the code itself, (e.g. parenthesis can be array access or function calls).

I don't really have any doubts that tree-sitter can handle it based on the fact it's able to parse what seem like more syntactically complex languages (e.g. Ruby, Rust, Python) but someone smarter than I (or at least with more time) probably needs to finish it.

[ievans]

@stadelmanma thank you so much for chiming in with the detailed comment! That's really helpful context.

[stadelmanma]

I fired up the old dev environment to try things out and made a couple needed changes that cause the test suite to fail but no parse errors in test/corpus. I'll try to fix the tests in the next few days, updating them isn't hard just tedious due to how the "assertions" are laid out.

@ievans and @dev-zero I'm not really sure whose court this ball falls into but I'll be happy to help as my time allows if you want to add Fortran support to this tool.