JS: Add URL constructor taint tracking for request forgery

[Napalys]

This PR enhances the request forgery (SSRF) detection by adding support for tracking taint flow through the URL constructor.

[Copilot]

Pull Request Overview

This PR enhances SSRF detection by tracking taint flow through the URL constructor in both tests and analysis logic.

• Added new test cases in serverSide.js to cover taint propagation via new URL(...)
• Updated expected results in RequestForgery.expected for the new flows
• Extended the taint analysis in RequestForgeryCustomizations.qll to recognize the URL constructor
• Documented the change in change-notes

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
javascript/ql/test/query-tests/Security/CWE-918/serverSide.js	Added a new server using new URL(input) and HTTP calls for SSRF
javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected	Updated expected taint flow edges for URL constructor cases
javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll	Introduced an exists clause for taint flow through URL
javascript/ql/lib/change-notes/2025-05-30-url-package-taint-step.md	Added a note about the minor analysis update

Comments suppressed due to low confidence (1)

javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll:87

• There is an extra '|' before the succ clause in the exists expression. QL expects a single '|' followed by combined predicates; replace the second '|' with 'and' or separate conditions with commas.

|