Add CDS Utils path injection query

[knewbury01]

What This PR Contributes

• A path injection/traversal query PathInjection.ql
• Unit tests for the query
• A patch to the prior model of CDS utils taint steps for a mistake in the modelling of args/calls as in/out nodes

Future Works

Add additional unit tests if the extra API cases described here in the future works are covered in the future.

[jeongsoolee09]

Nice work. I'd like to suggest two things:

Lack of barriers

A barrier is lacking in this example. Research some well-known ways to neutralize path traversal and ones that are specific to CAP, and add both to the Recommendations section of the help file and to the isBarrier predicate of the configuration.

CDSAdditionalFlowStep hard to understand at first glance

It's a bit hard to follow the logic of CDSAdditionalFlowStep, and much of it is coming from the fact that conceptually a flow step is a pair of two dataflow nodes but the implementation at the moment is a DataFlow::Node.

But admittedly encoding a tuple can be a bit verbose to model in QL. So I think it's better to remove the hierarchy only for additional flow steps and directly inline the class definition into the isAdditionalStep predicate. It seems like the default queries are following this practice.

[jeongsoolee09]

Good work! LGTM!