feat: Add Android static analysis workflow with Jadx, OpenGrep, and MobSF

Comprehensive Android security testing workflow converted from Prefect to Temporal architecture:

Modules (3):
- JadxDecompiler: APK to Java source code decompilation
- OpenGrepAndroid: Static analysis with Android-specific security rules
- MobSFScanner: Comprehensive mobile security framework integration

Custom Rules (13):
- clipboard-sensitive-data, hardcoded-secrets, insecure-data-storage
- insecure-deeplink, insecure-logging, intent-redirection
- sensitive_data_sharedPreferences, sqlite-injection
- vulnerable-activity, vulnerable-content-provider, vulnerable-service
- webview-javascript-enabled, webview-load-arbitrary-url

Workflow:
- 6-phase Temporal workflow: download → Jadx → OpenGrep → MobSF → SARIF → upload
- 4 activities: decompile_with_jadx, scan_with_opengrep, scan_with_mobsf, generate_android_sarif
- SARIF output combining findings from all security tools

Docker Worker:
- ARM64 Mac compatibility via amd64 platform emulation
- Pre-installed: Android SDK, Jadx 1.4.7, OpenGrep 1.45.0, MobSF 3.9.7
- MobSF runs as background service with API key auto-generation
- Added aiohttp for async HTTP communication

Test APKs:
- BeetleBug.apk and shopnest.apk for workflow validation

workers/android/Dockerfile

@@ -7,8 +7,10 @@
 # - Frida (dynamic instrumentation)
 # - androguard (Python APK analysis)
 # - MobSF dependencies
+#
+# Note: Uses amd64 platform for compatibility with Android 32-bit tools
 
-FROM python:3.11-slim-bookworm
+FROM --platform=linux/amd64 python:3.11-slim-bookworm
 
 # Set working directory
 WORKDIR /app
@@ -23,7 +25,7 @@ RUN apt-get update && apt-get install -y \
     unzip \
     # Java (required for Android tools)
     openjdk-17-jdk \
-    # Android tools dependencies
+    # Android tools dependencies (32-bit libraries for emulated amd64)
     lib32stdc++6 \
     lib32z1 \
     # Frida dependencies
@@ -34,9 +36,19 @@ RUN apt-get update && apt-get install -y \
     # Network tools
     netcat-openbsd \
     tcpdump \
+    # MobSF dependencies
+    xfonts-75dpi \
+    xfonts-base \
     # Cleanup
     && rm -rf /var/lib/apt/lists/*
 
+# Install wkhtmltopdf (required for MobSF PDF reports)
+RUN wget -q https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox_0.12.6.1-3.bookworm_amd64.deb && \
+    apt-get update && \
+    apt-get install -y ./wkhtmltox_0.12.6.1-3.bookworm_amd64.deb && \
+    rm wkhtmltox_0.12.6.1-3.bookworm_amd64.deb && \
+    rm -rf /var/lib/apt/lists/*
+
 # Install Android SDK Command Line Tools
 ENV ANDROID_HOME=/opt/android-sdk
 ENV PATH="${ANDROID_HOME}/cmdline-tools/latest/bin:${ANDROID_HOME}/platform-tools:${PATH}"
@@ -75,20 +87,56 @@ RUN pip3 install --no-cache-dir androguard pyaxmlparser
 # Install Frida
 RUN pip3 install --no-cache-dir frida-tools frida
 
+# Install OpenGrep/Semgrep (expose as opengrep command)
+RUN pip3 install --no-cache-dir semgrep==1.45.0 && \
+    ln -sf /usr/local/bin/semgrep /usr/local/bin/opengrep
+
+# Install MobSF (Mobile Security Framework)
+RUN git clone --depth 1 --branch v3.9.7 https://github.com/MobSF/Mobile-Security-Framework-MobSF.git /app/mobsf && \
+    cd /app/mobsf && \
+    ./setup.sh
+
+# Install aiohttp for async HTTP requests (used by MobSF scanner module)
+RUN pip3 install --no-cache-dir aiohttp
+
 # Create cache directory
 RUN mkdir -p /cache && chmod 755 /cache
 
 # Copy worker entrypoint (generic, works for all verticals)
 COPY worker.py /app/worker.py
 
+# Create startup script that runs MobSF in background and then starts worker
+RUN echo '#!/bin/bash\n\
+# Start MobSF server in background\n\
+echo "Starting MobSF server in background..."\n\
+cd /app/mobsf && ./run.sh 127.0.0.1:8877 > /tmp/mobsf.log 2>&1 &\n\
+MOBSF_PID=$!\n\
+echo "MobSF started with PID: $MOBSF_PID"\n\
+\n\
+# Wait a moment for MobSF to initialize\n\
+sleep 5\n\
+\n\
+# Generate and store MobSF API key\n\
+if [ -f /root/.MobSF/secret ]; then\n\
+    SECRET=$(cat /root/.MobSF/secret)\n\
+    export MOBSF_API_KEY=$(echo -n "$SECRET" | sha256sum | cut -d\" \" -f1)\n\
+    echo "MobSF API key generated and exported"\n\
+fi\n\
+\n\
+# Start worker\n\
+echo "Starting Temporal worker..."\n\
+exec python3 /app/worker.py\n\
+' > /app/start.sh && chmod +x /app/start.sh
+
 # Add toolbox to Python path (mounted at runtime)
 ENV PYTHONPATH="/app:/app/toolbox:${PYTHONPATH}"
 ENV PYTHONUNBUFFERED=1
 ENV JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
+ENV MOBSF_PORT=8877
 
 # Healthcheck
-HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=5 \
     CMD python3 -c "import sys; sys.exit(0)"
 
-# Run worker
-CMD ["python3", "/app/worker.py"]
+# Run startup script (starts MobSF + worker)
+CMD ["/app/start.sh"]