formulary: map resolves information from API

[Bo98]

This fixes false positives with brew vulns when using the API

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• AI was used to generate or assist with generating this PR.

---

[Copilot]

Pull request overview

This PR updates Homebrew’s API-backed formula loading to preserve patch “resolves” metadata from the formula API JSON, which helps brew vulns avoid false positives when formulas are sourced from the API rather than from Ruby files.

Changes:

• Map patches[].resolves[].id entries from API JSON into the in-memory patch resource when constructing formulas from API structs.
• Extend the formulary spec to assert that ExternalPatch#resolves includes IDs provided by the API (e.g., CVE + issue URL).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
Library/Homebrew/formulary.rb	When building patches from API structs, passes API resolves IDs into the patch DSL via resolves(...).
Library/Homebrew/test/formulary_spec.rb	Adds coverage asserting that patch resolves IDs from API JSON are reflected on the resulting ExternalPatch.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.