Java: Add java.lang.Number as a sanitizer for SQL injection.

[aschackmull]

Fixes #2722

[yo-h]

The private TypeNumber defined in Random.qll conflicts with the new definition in JDK.qll (see test failures).

[JLLeitschuh]

Just a "how does this thing work" question: is it an API breaking change to move types around? I'm guessing it probably is from an import perspective, but not in other ways? Maybe?

[yo-h]

Just a "how does this thing work" question: is it an API breaking change to move types around? I'm guessing it probably is from an import perspective, but not in other ways? Maybe?

What happened here is that a type name was introduced into JDK.qll, which is imported by java.qll, which is imported by Random.qll, which already contained a type with the same name.

See the section on Name resolution for details on how name resolution works in QL, in particular the notion of "definite" environment.