Add send_file warning

[ulziibay]

Adds a check when there might be a dataflow from user input to a sink.
"How to serve static files in Flask" is the most asked question in Stackoverflow for Flask. Hence, this will be a popular check if we do it right.

Pending def $X(filename: $Y, ...): support integration in https://github.com/returntocorp/sgrep.

Testing:

1. Run rule

sgrep-lint ~/Workspace/sgrep-rules/python/flask/secure-static-file-serve.yaml ~/Workspace/sgrep-rules/tests/python/flask/send_static_file/test_send_file_without_path_sanitization.py| jq

2. See it fire on

@app.route("/<path:filename>")
def download_file(filename):
  return send_file(filename) .  ## CATCHES THIS

[ievans]

@ulziibay shouldn't filename be a metavariable, eg $F?

[ievans]

Ideally we would have decorator support here semgrep/semgrep#29