Implement queries for authentication / authorization related issues

[jeongsoolee09]

What this PR contributes

Queries

This PR contributes three queries:

1. DefaultUserIsPrivileged.ql
2. EntityExposedWithoutAuthn.ql
3. NonProductionStrategyUsed.ql

DefaultUserIsPrivileged.ql

Addresses #107's misused-privilged-user/default-is-privileged PoC.

EntityExposedWithoutAuthn.ql

Addresses #107's entities-with-no-authn PoC.

NonProductionStrategyUsed.ql

Addresses #107's nonprod-authn-strategy PoC.

Libraries

• Thoroughly debugged CqlClause in CQL.qll.
• Improved and added more classes to CDS.qll.
  • Better handling of global variable definitions using type tracker.
  • Added classes on cds.user and privileged users.
  • Added classes on transactions.
  • Classes now also capture await expressions as well as their non-await expressions.
• Added Conditionals.qll to find expressions and statements that act as conditionals.
• Added more classes to PackageJson.qll.

Tests

• Added model tests on authz-annotations, conditionalstatements.
• Added model tests on entityreference where the entity resolving mechanism is tested.

Future Work

• Figure out and write query for dynamically-generated-privileged in Add authentication/authorization related PoCs #107.
• Write accompanying help files in md.

[mbaluda]

A couple of thoughts:

• Remove dynamically-generated-privileged and dependencies if it's not in scope right now
• DefaultUserIsPrivileged should be a path-preoblem
• EntityExposedWithoutAuthn missing description
• EntityExposedWithoutAuthn do not repeat the primary location link

[mbaluda]

LGTM 🚀