JS: Reintroduce js/resource-exhaustion

[esbena]

This reintroduces the reverted js/resource-exhaustion - see original PR and its revert.

This is a bit of a sad PR. The first commit contains a query with flow labels, the second commit removes the use of the flow labels completely. The flow labels were used to distinguish between numbers and other types, since some sinks only works with numbers. I do not think the overhead of the flow labels is worth the potential results (which I expect to be very rare). The result is a faster query with fewer sinks.

I think the likelihood that the remaining sink setTimeout(SINK) will be hit in the wild is high enough that I want to merge the query in this restricted version instead of shelving the full query among the queries that are not run by default. We can add flow labels later to regain the remaining sinks.

Sample run: https://lgtm.com/query/2428900331474891062/

Can I get a proper dist-compare run? With the security suite or another RemoteFlow taint query for establishing the baseline?

[esbena]

I have removed the documentation label since the documentation has been reviewed in #3702 already.

[esbena]

(the check failure is just the usual one for missing qldoc on the Customization module pattern)

[erik-krogh]

It all looks good to me (assuming that an evaluation looks ok).

[erik-krogh]

I made an evaluation against a where none() edition of the query.

Definitely shows a slowdown.
I'm not sure if the slowdown is acceptable.

[esbena]

Thanks for checking. Lets shelve this in /experimental for now then (I have moved all files there).