JS: add ad hoc whitelist checks as sanitizers

[ghost]

Adds support for whitelist sanitizer calls, based on the callee name:

if (isWhitelisted(v)) {
    // v is sanitized
}
if (config.allowValue(v)) {
    // v is sanitized
}

This is a slightly more heuristic sanitizer implementation than the existing ones, let me know if it is too heuristic.

Motivated by this FP: https://lgtm.com/projects/g/hmcts/ccd-api-gateway/snapshot/3dd64210f75c172ae64a2b471690eb9ff9dad2ee/files/app/security/cors.js?#x628dfb3697365894:1

Evaluation (internal link): no changes.

[xiemaisi]

I'm not averse to having a heuristic check like this, but I'm bit wary of adding it to all configurations. Could we for now just add it to the one where we observed the FP?

Also, you'll probably want to check that the substring auth of the name isn't part of unauthorized or author or similar.

[ghost]

Comments addressed.
I have also optimistically added a general change note for improved sanitizers instead of mentioning this as a query-specific improvement.

[xiemaisi]

LGTM, but a second opinion from @asger-semmle would be great.

[asger-semmle]

LGTM as well. I'll probably want to use this in the query I'm working on right now.