## Description
Don't use trunk, because if a vulnerability fix has been merged, this
requires PRs to rebase. Instead, try to find a merge base where possible
and use that as the reference point to ensure no new vulnerabilities are
being introduced by a PR.

## Motivation and Context
Recent OWASP job failures

## Impact
Less false positives from the OWASP job

## Test Plan
Old commit without newer security vulnerability fixes doesn't trigger
OWASP failure anymore: tdcmeehan#12
Previous vulnerability detection continues to work:
tdcmeehan#13

## Contributor checklist

- [ ] Please make sure your submission complies with our [contributing
guide](https://github.com/prestodb/presto/blob/master/CONTRIBUTING.md),
in particular [code
style](https://github.com/prestodb/presto/blob/master/CONTRIBUTING.md#code-style)
and [commit
standards](https://github.com/prestodb/presto/blob/master/CONTRIBUTING.md#commit-standards).
- [ ] PR description addresses the issue accurately and concisely. If
the change is non-trivial, a GitHub Issue is referenced.
- [ ] Documented new properties (with its default value), SQL syntax,
functions, or other functionality.
- [ ] If release notes are required, they follow the [release notes
guidelines](https://github.com/prestodb/presto/wiki/Release-Notes-Guidelines).
- [ ] Adequate tests were added if applicable.
- [ ] CI passed.
- [ ] If adding new dependencies, verified they have an [OpenSSF
Scorecard](https://securityscorecards.dev/#the-checks) score of 5.0 or
higher (or obtained explicit TSC approval for lower scores).

## Release Notes

```
== NO RELEASE NOTE ==
```

Velox already provides three layers of mitigation: CachedBufferedInput
with 512KB coalesce distance, FileHandleCache (LRU, avoids re-open),
and AsyncDataCache (caches footer + data pages). Footer cache is the
key win for RPT backward pass. Forward pass cost varies by storage:
local NVMe is fine, S3 is expensive but parallelizable. Suggest tunable
maxCoalesceDistance for RPT key-column scans on high-latency storage.

https://claude.ai/code/session_01SAXk4AS8yQyQkhRVi6RQie

Increasing maxCoalesceDistance to 256MB would read through ~122MB gaps
between key column pages across row groups, reading ~100% of the file
to get 5% of data — defeating column pruning entirely. The default
Velox behavior (512KB coalesce within RG, separate I/O across RGs) is
correct. S3 forward pass uses 50 parallel 6MB GETs per file (~75ms
wall clock), which is a standard S3 access pattern. Concern is moderate,
not blocking.

https://claude.ai/code/session_01SAXk4AS8yQyQkhRVi6RQie

RPT's key-column reads are not extra I/O — the main query would read
those same pages as part of full row group reads. Total I/O is identical
(6.4GB with or without RPT). RPT front-loads 300MB to build BFs that
prune the main query. Even worst case (no pruning), overhead is ~5%
from extra S3 requests. With 90% selectivity, total I/O drops to 940MB
(6.8x savings). Issue resolved.

https://claude.ai/code/session_01SAXk4AS8yQyQkhRVi6RQie