feat: support codeql

[brandonspark]

What:

This PR introduces the QL language (used by CodeQL) to Semgrep.

Why:

It's funny.

How:

Did the generic translation, augmented by an intermediate AST to clarify things, and added some tests.

Closes SAF-947

[github-actions]

📸 The pytest shapshots changed in your PR.
Please carefully review these changes and make sure they are intended:

1. Review the changes at 8302d27

2. Accept the new snapshots with

   git fetch origin && git cherry-pick 8302d27 && git push
   

[emjin]

Looks good to me, except I would rather you use unsafe_fake_tok a lot less. I didn't include a comment on each one, but I think in almost every place you could have used fake_tok_loc instead with minimal hassle. Given that this isn't the most important language to us it's ok with me if you merge this without addressing that.

[github-actions]

PR checklist:

• Purpose of the code is evident to future readers
• Tests included or PR comment includes a reproducible test plan
• Documentation is up-to-date
• A changelog entry was added to changelog.d for any user-facing change
• Change has no security implications (otherwise, ping security team)

If you're unsure about any of this, please see:

• Contribution guidelines!
• One of the more specific guides located here