JS: add new prototype pollution query and reorganize

[asgerf]

Adds js/prototype-polluting-assignment for flagging property assignments of the form obj[x].prop = value where x may be the user-controlled value __proto__.

Since the property read obj[x] and the assignment base.prop = value can occur arbitrarily far away from each other, we use a flow label to track the value from obj[x] to base.

Currently the new query does not do anything special to account for the constructor.prototype payload, as such sinks are often exploitable by __proto__ as well (the notable exception being when people explicitly guard against __proto__ but not constructor/prototype).

Also reorganizes the prototype pollution queries, moving all to the Security/CWE-915 folder and tagging them with CWE-079, CWE-094, CWE-400, and CWE-915.

Also, the query js/type-confusion-through-parameter-tampering now treats the x in x === "__proto__" as a sink, since it can be bypassed by ["__proto__"], slightly simplifying the sanitizer logic in the new query.

Evaluations: (internal links)

• Smoke test looks good - acceptable performance for a new query
• Performance commits alone, based on main, and based on this PR, both show about 60% speed-up for bwip, and neutral performance otherwise, perhaps leaning slightly towards a general speedup.
• Larger evaluation (re-run of slowest) shows decent performance for a new query, and a good number of new results.

[erik-krogh]

Good query, nice results, great performance 👍

Just a few minor comments for now.

[asgerf]

Thanks for the review!

Evaluation and rerun of slowest look good (internal inks). Added the links to the PR description as well.

[asgerf]

@mchammer01 may I ask you for a doc review?

[mchammer01]

Yes sure, will try to fit this in later today or tomorrow.

[mchammer01]

@asgerf 👋🏻
This LGTM ✨
There's a tiny typo, and also, I think the CWE should be CWE-078 and not 079 on the new query)
Apart from that, I have made a few minor comments, feel free to ignore them if you don't agree 🙂

[asgerf]

Thanks for the review @mchammer01, I've addressed the comments.

[mchammer01]

Thanks for addressing my comments @asgerf ⚡ ✨
This is good to go from a docs point of view 👍🏻

[asgerf]

Just a few minor comments for now.

@erik-krogh any final comments from your end?

[erik-krogh]

@erik-krogh any final comments from your end?

Nope. LGTM.