Address deprecation of PathExpr and port ZipSlipQuery

[jeongsoolee09]

What This PR Contributes

Rewrite XSJSZipSlip with new data flow APIs

XSJSZipSlip was the only query that wasn't ported to the newer data flow API in PR #220. This PR not only ports the query to using the newer API, it rewrites the entire query to be visually and conceptually cleaner.

WebRequestBody as unified RemoteFlowSource

Previously, methods asArrayBuffer, asString, and asWebRequest on these types were RemoteFlowSources on their own:

• WebRequestBody (having access paths $.request and $.request.entities.* in source code)
• InboundResponse.body (having acess paths $.net.http.Client::getResponse().body() in source code)

This made alert reporting a bit perplexing both conceptually and practically, as (1) these method calls could be mistaken as a side-effecting entrypoint that pulls data in, and (2) the data flow as reported starts from the call to these methods and not the actual request body or a response.

Therefore, we place the WebRequestBody on the sourceModel and leave only the InboundResponse on the sourceModel, and calls to the above three methods on the summaryModel.

Clean up, port, and streamline XSJSZipSlipQuery

• XSJSZipInstanceDependingOnRemoteFlowSource is unnecessary when we have a combination of (1) unified RemoteFlowSource discussed above, (2) the data flow that starts from it, and (3) a stateful data flow config (enforcing the taint tracking to filter out flows that does not have an XSJSZipInstance along the way).
• XSJSRemoteFlowSourceToZipInstanceStep is a special case of a kind of step already covered by the data flow library.
• Port ZipEntryPathIndexOfCallEqualsZeroGuard to use DataFlow::MakeBarrierGuard.
• Demote the ForInLoopDomainToVariableStep to a query-dependent step, from being a SharedFlowStep.

Replace deprecated PathString with FileSystem::Folder::Resolve

• PathString is deprecated, so use FileSystem::Folder::Resolve<shouldResolve/2>::resolve where shouldResolve restricts the possible set of (container, path) pairs using the predefined isAnUnResolvedResourceRoot.

Miscellaneous

• Remove rows that are commented out in xsjs.model.yml.
• Remove obsolete module webBody.qll.

Future Works

• Remove the deprecated DbLocation in ListXssPartialPaths.