chore: switch to ID from AVDID in internal and user-facing fields

[nikpivkin]

Description

Migration from AVDID to ID in PolicyMetadata and DetectedMisconfiguration

This PR continues the migration of check identifiers from AVDID to a unified ID field.

Key changes:

• The ID field in types.PolicyMetadata now stores the check identifier (the ID field) instead of AVDID or the first alias.

  • Since PolicyMetadata is mapped into types.DetectedMisconfiguration, the ID field in DetectedMisconfiguration is also updated.
  • The link format in DetectedMisconfiguration.PrimaryURL will change because it is built based on the PolicyMetadata.ID field.
  • All built-in checks currently have an ID, so the ID field in PolicyMetadata and DetectedMisconfiguration will never be empty.

• DetectedMisconfiguration is serialized to JSON and proto (Scanner service), while PolicyMetadata is serialized only to proto and used in the Cache service. Therefore, this change may affect downstream consumers depending on how they use these fields.

• The link format for built-in checks in tabular reports will change to use the check ID. Support for the new format has already been added in avd-generator.

• Trivy now associates controls from compliance with misconfiguration findings not only by AVDID but also by ID.

Impact:

Users who directly work with the ID or PrimaryURL fields in JSON/proto may notice changes in the format of identifiers and check links.

Related PRs

• refactor(misconf): mark AVDID fields as deprecated and use ID internally #9576

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).