Add CWE-918 model regression coverage for Apache Http Fluent Request sinks

[Copilot]

Adds targeted SSRF model tests for org.apache.http.client.fluent.Request, including the required test stubs and classpath wiring in the CWE-918 test configuration.

• What this addresses

  • Extends CWE-918 model regression coverage to Apache Http Fluent APIs that are modeled as request-forgery sinks.
  • Follows the existing SSRF test style used in this suite (inline // $ Source and // $ Alert expectations).

• Test coverage added

  • New test file: java/ql/test/query-tests/security/CWE-918/ApacheHttpFluentSSRF.java
  • Covers these static sink entry points on Request:
    • Delete, Get, Head, Options, Patch, Post, Put, Trace
    • both (String) and (URI) overloads

• Stub + test configuration updates

  • Added stub: java/ql/test/stubs/apache-http-fluent-4.5.14/org/apache/http/client/fluent/Request.java
  • Updated java/ql/test/query-tests/security/CWE-918/options to include the new stub directory on the test classpath.

• Example from new test

  String sink = request.getParameter("uri"); // $ Source
  URI uri = new URI(sink);
  
  Request.Get(sink); // $ Alert
  Request.Get(uri);  // $ Alert

Original prompt

Please add tests for the models for this class. Look at the other SSRF tests in java/ql/test/query-tests/security/CWE-918/CWE-918.testproj/src/Users/owen-mc/workspace/code/ql/java/ql/test/query-tests/security/CWE-918/ApacheHttpSSRF.java to an example to follow. You will have to add stubs and add the path to them in the file java/ql/test/query-tests/security/CWE-918/options . Look at that file to see where the stubs should be located. You can look at existing stubs to see what they should be like.

Created from VS Code.