[gricha]

Adds lookupMayMatchNullRows to the decision-model linter's security suite.

An exact ORM lookup whose value can be None, like filter(user_id=request.user.id) for an API key, compiles to user_id IS NULL and matches rows with no user: pending invites, deleted users' exports, token-created rows. That caused #129441, #129442 and #129443, and the two fixes below this PR (#129538, #129540). Flake8 rule S032 only catches a literal acting_user_id(...) keyword, so it missed all of them.

The rule runs on changed files only, at warn. Its report says how to fix it: decide whether None means no rows (check for None first, or owned_by_acting_user() for the caller's own rows), no filter, or NULL rows (pass None or __isnull=True).

An earlier version of this PR was a mypy plugin. On top of the request.user stack it found 147 such lookups in 74 files; that list is the cleanup worklist, handled in follow-up PRs instead of an allowlist here.

Checked locally with this config: the full security suite in diff mode, as CI runs it, on 12 diffs. Seven add one of this week's bugs and five add lookups that are fine. The threshold is 0.7.

Diff adds	P(TRUE)	Flagged
Data export lookup by request.user.id (#129442)	0.81	yes
is_member projects by request.user.id (#129443)	0.83	yes
Member roles by request.user.id (#129538)	0.80	yes
Replay access by request.user.id (#129540)	0.79	yes
Team unsubscribe by member.user_id (#129600)	0.72	yes
Dashboard edit check (#129441)	0.51	no
Sentry app token rescope (#129602)	0.10	no
An __isnull=False guard	0.27	no
An application_id is None guard	0.14	no
dist_id=dist.id if dist else None	0.13	no
Global user options (project_id=None)	0.46	no
Derived pipeline_hash (commented as meant)	0.35	no

The two misses: #129441's None comes through an untyped parameter and a ==, and #129602 depends on SentryApp.application being nullable, which the diff doesn't show. A diff that only deletes a guard isn't checked either, since the linter asks about added lines. An earlier, more abstract wording flagged none of the seven.

Reviewer cases (re-measured Nov 2, changeset mode, full security suite):

Case	Expected	P(TRUE)
UserEmail.objects.filter(user_id=authenticator.user_id), NOT NULL column	no warning	0.19
filter(project_id=project_id) where None means the global user option	no warning	0.49
organization_service.check_membership_by_id(user_id=request.user.id), lookup behind a service call	warning	0.22 (missed)

The two false-positive risks stay under the 0.7 threshold. A rewording that limits the rule to nullable columns, exempts "None means global" and mentions service calls dropped two real bugs below it (#129540 to 0.63, #129600 to 0.55) and still missed the service call. A lighter one kept 5 of 8 but left #129540 and #129600 at 0.72 and 0.70. So the wording stays; lookups behind service calls are a known gap.

[sentry]

Sentry Snapshot Testing

Name	Added	Removed	Changed	Renamed	Unchanged	Skipped	Status
sentry-frontend sentry-frontend	0	0	0	0	780	0	✅ Unchanged

⚙️ sentry-frontend Snapshot Settings

[azulus]

:bufo-hype: