JS: moved execa out of experimental

[Napalys]

No description provided.

[Copilot]

Pull Request Overview

This PR promotes the execa library model from experimental to stable, migrating its tests into the main query-tests directories and updating the QL framework import.

• Added execa.js under Security/CWE-078 and Security/CWE-022 with appropriate $Source/$Alert tags
• Updated expected result files to include execa.js entries for both command and path injection
• Removed experimental Execa tests and updated javascript.qll to import the stable Execa framework; added a change note

Reviewed Changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/execa.js	New tests for command injection with various execa calls
javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/CommandInjection.expected	Updated expected alerts for execa.js entries
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/execa.js	New tests for path injection via execa input/output options
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected	Updated expected alerts for path injection tests
javascript/ql/lib/javascript.qll	Imported semmle.javascript.frameworks.Execa for stable model
javascript/ql/lib/change-notes/2025-06-20-execa.md	Added change note for Execa promotion
javascript/ql/test/experimental/Execa/**	Removed obsolete experimental Execa tests

[asgerf]

We already have a model of execa in SystemCommandExecutors.qll. I'd rather have only one model in one place. Could you make sure the new model covers all the same cases as the old one and then remove the old one?