Java: add Spring models

[jcogs33]

This PR adds a path-injection sink for org.springframework.core.io.Resource#createRelative(String) and a source for org.springframework.web.util.UrlPathHelper#getPathWithinApplication in order to cover CVE-2019-3799.

Additional UrlPathHelper sources are also added and their existing taint steps are removed. Let me know if anything looks wrong with these changes.

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

• Changes to framework-coverage-java.rst:

-    `Spring <https://spring.io/>`_,``org.springframework.*``,29,489,117,4,,28,14,,35
+    `Spring <https://spring.io/>`_,``org.springframework.*``,38,481,118,5,,28,14,,35
-    Totals,,299,18929,2423,315,16,122,33,1,401
+    Totals,,308,18921,2424,316,16,122,33,1,401

• Changes to framework-coverage-java.csv:

- org.springframework.core.io,2,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,
+ org.springframework.core.io,3,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,1,,,,,,,,,,,,,,,
- org.springframework.web.util,,,165,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,140,25
+ org.springframework.web.util,,9,157,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,132,25