fix: handle flow correctly for sanitizer rules

[didroe]

Description

Moves the responsibility for sanitization rules to the evaluator. This allows us to terminate the match properly in the presence of flow/unified nodes.

Previously we wouldn't consider this case sanitized:

x = params[:oops]
y = sanitize(x)

unsafe_call(y)

Checklist

• I've added test coverage that shows my fix or feature works as expected.
• I've updated or added documentation if required.
• I've included usage information in the description if CLI behavior was updated or added.
• PR title follows Conventional Commits format

[elsapet]

Looks good 🙌

For my interest, are there any related bearer-rules changes, or will these come later?

[didroe]

@elsapet Yeah there are rule changes that I'll be making a PR for soon