JS: Make moduleImport() work for named imports

[asger-semmle]

Fixes https://jira.semmle.com/browse/ODASA-6953, so QL like this

DataFlow::moduleImport("foo").getAPropertyRead("bar")

now matches code like this

import { bar } from "foo";

We're low on workers so I will start a full evaluation after reviews.

[xiemaisi]

That looks refreshingly simple! It's unfortunate we still treat named imports and default imports differently (and the test failure looks like it might be related to that), but it's certainly a big step in the right direction. Modulo evaluation and remaining test failures, this lvgtm!

[asger-semmle]

Right, I had forgotten about the ambiguous interpretation of default imports. Generalized it to default imports and checked that the test results are indeed to be expected and reasonable.

[xiemaisi]

Why do we get this flow?

[asger-semmle]

For reference here's nodeJsLib.js

let source1 = "tainted";
let source2 = "tainted";

module.exports = source1;

exports.foo = source2;

The exported object itself is tainted, and we have a taint step through property reads, so there is a path step from source1 -> (exports object).foo. This PR models import {foo} from 'nodeJsLib' as a PropRead so that step is new.

It shouldn't matter in practice since module exports objects are never tainted.

[asger-semmle]

Evaluation is uneventful.