ATM: Boost XssThroughDOM

[tiferet]

This is a new version of #11204 based on top of the CodeQL refactoring, of which #11323 is the final PR.

@jhelie Because rebasing was too hard, I created this new version of your PR based on top of the new CodeQL framework. As I did this, though, I noticed that, as I understand it, there are more changes that need to be made when boosting a new query that are missing from your PR. Searching the repo for the substring XssAtm I found changes that I think need to be made for XssThroughDOM in the following files:

• javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/EndpointFeatures.ql
• javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/FilteredTruePositives.ql
• javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/DebugResultInclusion.ql
• javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/extraction/ExtractEndpointDataTraining.qll (this one will go away if we deprecate hasFlowFromSource from the training data)

The changes to the tests will also require changes to the .expected files, of course.

[jhelie]

I'm not sure why the tests are failing, I can run the query on my machine and the tests pass.

[henrymercer]

The tests run on a merge commit, and there have been changes on main since this PR. So I think we can resolve this by merging in main and updating the code, e.g. the getAlerts predicate specifically.

[jhelie]

I've merged main but I'm not sure which piece of code I'm supposed to update?

I see it, ignore me

[henrymercer]

Can you now reproduce the test failures locally?

[tiferet]

Note: When #11532 gets merged XssThroughDOM should be added to that test as well.

[adityasharad]

Code changes look good. Assuming no other concerns from the team, I recommend merging this as is, so we don't accumulate conflicts with other PRs, and evaluating the combined state of main.

[adityasharad]

Shall we just remove this comment now, so we don't forget later? Here and in the corresponding QLL file.

[jhelie]

This comment is present in all ATM-related .ql and .qll so probably best done in a separate PR given the churn. I'll open one.

[jhelie]

Merging now, and will evaluate new main state.