JS: recognize sanitizing slashes in URL redirection queries

[asger-semmle]

The sanitizer for our URL redirection queries is now more precise, so we no longer get false positives from things like:

res.redirect("/users/" + req.params.id);

The tricky thing about slashes is that they are used in multiple parts of the URL:

1. separating the (optional) scheme from the hostname
2. separating the hostname from the path
3. occurring inside the path, query, and/or fragment

The attacker must not be able to control the hostname, so we need to make sure a slash cannot be interpreted as (1). A redirection such as

res.redirect("/" + req.query.redirect)

is unsafe because it can lead to //evil.com.

I've also removed the Sink.maybeNonLocal() predicate from ServerSideUrlRedirect as it appears to implement the same sanitizer as the sanitizing prefix.

I'll run an evaluation, but just putting up for review now.

[ghost]

Also LGTM, but I would like clarification on the regexp.

[asger-semmle]

Performance goes both ways. I suspect the difference is that there are more sinks now (unreachable due to the sanitizer), so the exploratory flow steps reach a larger graph.

[asger-semmle]

I had also missed that the SSRF query depends on sanitizingPrefixEdge, and for SSRF the path is also considered vulnerable. So I've reverted sanitizingPrefixEdge to its original behaviour and introduced hostnameSanitizingPrefixEdge instead.

[xiemaisi]

Conflicts again.