JS: add model for the gray-matter library to js/code-injection

[erik-krogh]

Adds the sink for CVE-2022-25863.

The below function is basically equivalent to eval().

const greyMatter = require("gray-matter");

function myEval(code) {
  return greyMatter("---js\n" + code + "\n---").data;
}

console.log(myEval("1+3")); // prints 4

That seems to be a feature, so I've added a model.

If you set the option engines.js to some safe interpreter of JavaScript, then the library is safe from code-injection.
But that is hard to detect in a nice way if the options object comes from somewhere else.

Evaluation was uneventful