Java: add ssrf models discovered with heuristics

[jcogs33]

Description

• Adds some SSRF-related sink and summary models from the Apache HttpComponents framework that were discovered via heuristics. Most of these models are from Apache HttpComponents version 5, and a few are from version 4. (I included test cases for some of the version 5 models).
• Removes the existing sink model for org.apache.http.HttpRequest#setURI since this model is a typo and is covered by the model for org.apache.http.client.methods.HttpRequestBase#setURI instead.
• Updates the existing summary model for io.netty.handler.codec.http.HttpRequest#setUri to a sink model instead.

Consideration

• Let me know if the change note needs any edits. I thought it would be overkill to explicitly list all the packages that had models added, so I made it somewhat generic. Also, I used majorAnalysis since this PR adds a lot of Apache HttpComponents version 5 models, but let me know if it should be minorAnalysis instead.

[atorralba]

I started this review as if this PR was normal library modelling work (i.e. looking for both incorrect models and missing models), but I don't think that's the correct way to look at it, since you're adding only things found through heuristics.

So, consider my review to only have looked into correctness, but not completeness. With that in mind, this LGTM.

Also, I used majorAnalysis since this PR adds a lot of Apache HttpComponents version 5 models, but let me know if it should be minorAnalysis instead.

The distinction is subtle in this case because this is a big, popular library, so I don't think it matters much, but I feel inclined to always consider modelling work as minorAnalysis (unless we model something really fundamental, like the full JDK or a good part of it, that is virtually going to affect every analysis). I usually see majorAnalysis reserved to deeper changes, like an overhaul of the dataflow library or similar "everyone is impacted" things.

Feel free to leave it as it is if you have a strong opinion though.

[jcogs33]

Feel free to leave it as it is if you have a strong opinion though

I don't have a strong opinion, so I've switched it to minorAnalysis. 🙂