T-SQL rules

There aren't a lot of T-SQL security checkers out there, so lets add some rules for T-SQL scripts. Suggestions from Raul:

• Executing any of the dangerous XPs, such as xp_cmdshell
• Changing the configuration to enable dangerous features (i.e. EXEC[UTE] sp_configure ‘xp_cmdshell’, 1)
• Using dynamic SQL (i.e. EXECUTE).
  • The difficult part of this one would be to know if the dynamic SQL is properly escaped to prevent SQLi, so we could simply warn the user
• Enabling some features on DBs such as setting the trustworthy = ON on a DB
• Granting elevated permissions (i.e. GRANT UNSAFE ASSEMBLY … )
• Create a new login (with password) without CHECK_POLICY = ON

The issue names no files, tests, or entry points. Start by reviewing the existing rule and analyzer structure for SQL-related checks, then scope the proposed T-SQL rules, including dangerous XPs, dynamic SQL, database configuration, elevated permissions, and login policy; done means each agreed rule is implemented with coverage and documented warning behavior.