Java and JS: Add/adapt tests for literals with an unpaired surrogate character

[smowton]

Requires semmle-code PR to pass

[smowton]

@github/codeql-javascript this change (extracting invalid surrogates as U+FFFD not ?) turns out to introduce new FPs: ReDoS now thinks that [\uDC00\uDC01]|[\uDC02\uDC03] is vulnerable to exponential backtracking because all four "chars" are extracted as U+FFFD, and similarly the duplicate-character-in-class alert will misfire. Previously the extracted string was also problematic, using ? repeatedly, but both queries stayed quiet, perhaps mistaking the ? for a metacharacter?

Do you want to accept the new FPs or find a way to fix them?

Python's version of ReDoS had the same tests but they didn't work; it does produce these FPs once the test is fixed: #6665

[erik-krogh]

Do you want to accept the new FPs or find a way to fix them?

I want to fix them.
I've pushed a fix straight to this PR.

For now it handles both how surrogates look with the old/new databases.

[smowton]

@erik-krogh accidental inclusion of RegExpUnicodeEscape myThing(string v, int i) { ?

[smowton]

LGTM, will push the semmle-code pointer bump to this branch tip