JS: Model JSON schema validation and 'ajv'

[asgerf]

Adds a model of ajv along with some general concepts for JSON schema validation.

It has the following impact on our security queries:

• Validating an object against a schema blocks flow of the TaintedObject label, preventing FPs from queries like prototype pollution and NoSQL injection.
• Validating a deeply user-controlled object with allErrors: true is flagged as potential a denial-of-service attack. For this I introduced the somewhat generically-named query 'Resource exhaustion from deep object traversal'. It's only used for ajv at the moment, but I avoided using ajv or JSON schema validation as part of its name, so it's easier to extend in the future.
• The error message from ajv is treated as a source for ExceptionXss. This query has been rephrased to include errors in a more broad sense, which have not necessarily been through a throw/catch.
• Regular expressions in a JSON schema are now analyzed by our RegExp queries, if the JSON schema is written in a JS file. (See internal issue)

Evaluations (internal links):

• Security on default slugs looks ok.
  • I've confirmed that the minor regression found in the slowest repo goes away after rebasing on main. In particular, the caching of getAType fixed it.
• Security on ajv slugs shows a couple new results.

[erik-krogh]

Looks pretty good, I just have some minor comments.

Do we flag CVE-2020-8192 with the new query?

[asgerf]

Thanks @erik-krogh!

Addressed review comments. I also noticed I forgot to add the tests for the new query, so there's a new commit with tests as well.

Do we flag CVE-2020-8192 with the new query?

Ah, forgot to mention this, we don't flag this yet.