Severity defined in Sonar is ignored

[matiouz]

It seems that when creating an issue in sonar, the zap-sonar-plugin simply overrides the severity defined in the sonar rule with the one defined by zap.
This is what I gather from the code in ZapSensor.addIssue():

    context.newIssue()
        .forRule(RuleKey.of(ZapPlugin.REPOSITORY_KEY, String.valueOf(alert.getPluginid())))
        .at(new DefaultIssueLocation().on(context.module()).message(formatDescription(alert)))
        .overrideSeverity(severity)
        .save();

That's also the behaviour that I have observed.

However, it seems more convenient to allow the user to change the severity in sonar.
For example, different sonar projects could require different security levels.