JS: Support calls to returned functions

[asgerf]

A safer version of #3639, adds call edges to functions returned by other functions:

function outer() {
  return inner(x) { ... }
}

outer()(x); // call edge

Evaluations:

• security/nightly shows a fair number of new call edges. I've verified a few of them manually and saw only TPs.
• security/gecko looks fine (unlike JS: Track functions through props and returns #3639, which timed out on gecko)

[erik-krogh]

👍

[esbena]

LGTM. OOI Does this still solve the problems of https://github.com/github/codeql-javascript-team/issues/18, or more concretely, our problem with CVE-2020-7648?

[asgerf]

Does this still solve the problems of github/codeql-javascript-team#18,

It helps although still not entirely 'consistent' since returned .bind calls are still tracked further than plain functions.

or more concretely, our problem with CVE-2020-7648?

Yes, for CVE-2020-7648 it discovers the same call edge that #3639 was originally needed for.