I don’t know anything about “Oracle apps PL/SQL customized components and workflow customization” and “XML publisher report”.
SonarQube can analyze PL/SQL files but it doesn’t extract PL/SQL code from XML or any other file which is not a PL/SQL file. You can customize the file extensions which will be scanned by the PL/SQL analyzer (by default: sql, pks, pkb) but parsing errors are raised for anything which is not valid SQL or PL/SQL.