Javascript: Add new queries for Javascript actions

[R3x]

Added 3 Queries, that track flows from -

1. Action Input to Sinks
2. Action Github Context to Sinks
3. Action Environment to Sinks

[R3x]

@kevinbackhouse @JarLob - I have added the sinks that are of higher priority here. During the analysis - we also marked some lower-priority sinks (things such as fs.write etc). Which basically provides primitives such as an arbitrary file write - but not as severe as the ones here. Do you prefer that I add them as well?

[kevinbackhouse]

@kevinbackhouse @JarLob - I have added the sinks that are of higher priority here. During the analysis - we also marked some lower-priority sinks (things such as fs.write etc). Which basically provides primitives such as an arbitrary file write - but not as severe as the ones here. Do you prefer that I add them as well?

I think it's better to start with just the high-priority ones, so that you have a lower false-positive rate.

[JarLob]

Reformatting of the added lines may be needed.

[asgerf]

Hi @R3x and @JarLob 👋

First of all, sorry for the long radio silence.

These models seem very valuable, and I'd like to get them into the mainline outside experimental. However, I foresee some issues with code duplication, since this PR adds new variants of existing queries containing sinks we already have models for. It's difficult for us to maintain code with such duplication. Rather than merging to experimental and then do a round of clean-up afterwards, I've opened a PR adding the new sources as well as @actions/exec to mainline.

I haven't ported the "Actions Environment to Sink" query as I'm still not quite sure what the threat model is, but I'm thinking it could be part of js/shell-command-injection-from-environment

[R3x]

Closing this. since we have #12978