JS: Add support for importing files compiled into outDir from tsconfig.json

[erik-krogh]

Gets a TP/TN for CVE-2019-10778

I originally made this as part of the js/shell-command-constructed-from-input query.
But back then an evaluation came back with mixed results, so I shelved the implementation.

I dug the implementation up again, refactored it a bit, and added support for rootDir.

Performance looks fine now.

[asgerf]

Hm, the extractor already determines the effective main file for each package.json file. I'd prefer to extract that information and use it in QL, rather than redo the same work in QL.

[erik-krogh]

Hm, the extractor already determines the effective main file for each package.json file. I'd prefer to extract that information and use it in QL, rather than redo the same work in QL.

I'm not sure its straightforward to use that extractor code here.

The existing extractor code is only for determining the main import - without regards to where the compiled code ends up.
And the code in this PR is establishing a link between the source code and the compiled code.

[asgerf]

Ah, great! I looked at the code for the CVE and it seemed the main problem was to identify the entry point for the package, but I see now that the problem is actually connecting that entry point to the real package contents. 👍