JS: add more models for file related sinks and sources

[erik-krogh]

Adds new sinks/sources related to NPM libraries that does file operations.

The sinks are mostly related to js/path-injection, but there are also a few other queries that benefit from these added sources/sinks.

Here is a LGTM run that shows some (mostly safe) uses of the new sinks.

An evaluation on relevant queries show good performance, and a single new result that looks like a TP (but is not dangerous).

I found some other sinks that use some promise flow, I'll try those out after #3036 has been merged.

I've chosen not to include the popular del library as a sink, as it protects against deleting the current working directory and above.

[esbena]

Generally LGTM. I just have a few non-semantic requests.

Regarding ProducesFileNames and ProducedFileName, do you have other uses of those classes in the pipeline? Otherwise, it seems like a minor overkill to introduce them for a single use case in RecursiveReadDir.

[esbena]

Shouldn't this be getAFileName as this the output of the producer. getAFileNameSource makes it sound like it is the input.
(I do realise that this is the predicate name used in FileNameSource, but that class is using a different perspective)

[erik-krogh]

Regarding ProducesFileNames and ProducedFileName, do you have other uses of those classes in the pipeline? Otherwise, it seems like a minor overkill to introduce them for a single use case in RecursiveReadDir.

Yes, I expect to use ProducesFileNames again in later PRs.

[esbena]

LGTM.
Now we only need a giant change note, perhaps restricted to just the most popular libraries you have modelled here.