JS: Add flow step to ...rest parameters

[kaeluka]

This adds a flow step that has been missed for flow that goes from an argument to a ...rest parameter, eg:

f('x', 1, 2);
//        |
// ...    |
//        +-----------------+
function f(x, ...rest) { // |  
  console.log(rest[1]);  // |
//            ^^^^^^^       |
//                 |        |
//                 +--------+
}

This helps find one of the example I posted in #8846.

I'll trigger an experiment to see what other results this will get. Could easily turn up things.

[github-advanced-security]

Found 1 vulnerability.

[kaeluka]

@asgerf, as you already know the context of this PR, would you be able to review this? 🙇

[asgerf]

LGTM provided the tests pass