Go: Introduce Threat Modeling

[egregius313]

Initial implementation of threat modeling in Go. Based on #15359 which introduced the threat modeling in C#.

The terms in the getSourceType implementations might not be the best for each individual remote source.

Note

The Go library currently does not appear to have any local sources modeled, so this currently only handles remote flow sources.

Important

This does not change the queries and libraries to use ThreatModelFlowSource. This merely introduces the class and a few minor changes to the class hierarchy to make later changes easier.
Changing queries to use ThreatModelFlowSource instead of RemoteFlowSource is tracked in #16709.

[owen-mc]

Looks great! One question: what is the string from getSourceType() ever used for? There are some cases where it could be more precise/consistent, but then I didn't actually see its value being used for anything so I wasn't sure if that was important.

[egregius313]

One question: what is the string from getSourceType() ever used for? There are some cases where it could be more precise/consistent, but then I didn't actually see its value being used for anything so I wasn't sure if that was important.

This might not be necessary for Go. In the C# library, this is used for some of the queries which give some extra information about the source in the alert message. For example:

codeql/csharp/ql/src/Security Features/CWE-089/SqlInjection.ql

Lines 19 to 24 in 24c9062

	string getSourceType(DataFlow::Node node) { result = node.(SourceNode).getSourceType() }
	from SqlInjection::PathNode source, SqlInjection::PathNode sink
	where SqlInjection::flowPath(source, sink)
	select sink.getNode(), source, sink, "This query depends on $@.", source,
	("this " + getSourceType(source.getNode()))

I can remove the getSourceType definitions if you would like.

[owen-mc]

I ran a poll amongst our colleagues and they unanimously voted for not introducing getSourceType. If you remove it in a separate commit then that commit can always be reverted if someone wants it in future. It sounds like they want to deprecate it and eventually remove it for java as well.

[egregius313]

@owen-mc sorry for the delay, but I have added the commit to remove getSourceType