Fix Semgrep findings in Python tooling (#5899)

- generate_docset.py: use SHA-256 instead of SHA-1 for the cache file
  name digest of downloaded images.
- generate_docset.py: suppress dynamic-urllib-use-detected; the URL
  scheme is restricted to http(s) right before the call.
- generate_natvis.py: suppress direct-use-of-jinja2; the template
  renders a local XML file with autoescape enabled.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

tools/generate_natvis/generate_natvis.py

@@ -139,9 +139,12 @@ if __name__ == '__main__':
 
     namespaces += [f'{namespaces[0]}::{ns}' for ns in inline_namespaces]
 
+    # The template renders a local XML file, not a web response, and autoescape is enabled.
+    # nosemgrep: python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2
     env = jinja2.Environment(loader=jinja2.FileSystemLoader(searchpath=sys.path[0]), autoescape=True, trim_blocks=True,
                                                             lstrip_blocks=True, keep_trailing_newline=True)
     template = env.get_template('nlohmann_json.natvis.j2')
+    # nosemgrep: python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2
     natvis = template.render(namespaces=namespaces)
 
     output = args.output or os.path.join(args.repo_root, 'nlohmann_json.natvis')