Improve CQL Injection Query

[jeongsoolee09]

What this PR contributes

• Improve CQL Injection Query.

  • A new class CqlQueryRunnerCall now expands and replaces TaintedCqlClause, now covering cds.run, cds.db.run, srv.run, and tx.run.
    • Also, it models CRUD-style "shortcut calls" that translates to running a CQL on a service under the hood.
  • Expand base objects as possible receivers of methods .run and property read entities:
    • EntityEntry is "absorbed" into EntityReference. Plus, EntityReference now covers more examples, namely, cds as a shortcut to cds.db.
  • Make the alert message more useful by making the query itself the primary location which is different from sink (the string concatenation).

• Add robust test cases (This is the gist of this PR, please take a look for the behavioral summary description of what this PR aims to implement).

  • send11-send17: Service1 runs query on the database service using cds.run and friends.
  • send21-send25: Service1 runs query on itself by await-ing the query.
  • send31-send37: Service1 runs query on itself using this.run and friends.
  • send41-send47: Service1 runs query on Service2 using Service2.run and friends.
  • send5: Service1 runs query on Service2 using CQN parsed with cds.ql.
  • send6: Service1 runs query on the database service using CQN parsed with cds.parse.cql.
  • send7: Service1 runs query on the database service using CQN parsed with global function CQL.
  • send81: Service1 runs query on Service2 using an unparsed CDL string (only valid in old versions of CAP).
  • send91-send97: Service1 runs query on Service2 using Service2.tx( tx => tx.run(...) ) and friends.
  • send101-send107: Service1 runs query on itself using this.tx( tx => tx.run(...) ) and friends.
  • send111-send117: Service1 runs query on the database service using cds.tx( tx => tx.run(...) ) and friends.
  • send121-send127: Service1 runs query on the database service using cds.db.tx( tx => tx.run(...) ) and friends.

Future works

• The alert message can be more refined: if a sink is in cds.read(...).from(...), only the cds.read(...) part is alerted on, where the entire chained method call is more desirable as a alert location.
• SensitiveExposure.ql seems to be quite brittle, it needs a rewrite. This PR only updates the query's reference to old definitions that are no longer available.

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.