Add lodash GroupBy as taint step

[Vasco-jofra]

Adds _.groupBy as a taint step.

This is analogous to the GroupByTaintStep class, which does the same for Object and Map.

https://github.com/github/codeql/blob/d83cbde1cb1263fb476a55ea5fd7972307138905/javascript/ql/lib/semmle/javascript/Collections.qll#L158C1-L166C4

[asgerf]

The relevant implementation for Map.groupBy is here:

codeql/javascript/ql/lib/semmle/javascript/internal/flow_summaries/Maps.qll

Lines 130 to 139 in 93c891a

	override predicate propagatesFlow(string input, string output, boolean preservesValue) {
	preservesValue = true and
	(
	input = "Argument[0].ArrayElement" and
	output = ["Argument[1].Parameter[0]", "ReturnValue.MapValue.ArrayElement"]
	or
	input = "Argument[1].ReturnValue" and
	output = "ReturnValue.MapKey"
	)
	}

This would be the closest matching implementation for _.groupBy I think:

   preservesValue = true and
   input = "Argument[0].ArrayElement" and 
   output = ["Argument[1].Parameter[0]", "ReturnValue.AnyMember.ArrayElement"] 

Note that there is currently no content corresponding to MapKey for the keys of a plain object.

[Vasco-jofra]

I based it on:

codeql/javascript/ql/lib/semmle/javascript/Collections.qll

Lines 158 to 166 in 4d2c678

	private class GroupByTaintStep extends TaintTracking::SharedTaintStep {
	override predicate heapStep(DataFlow::Node pred, DataFlow::Node succ) {
	exists(DataFlow::MethodCallNode call |
	call = DataFlow::globalVarRef(["Map", "Object"]).getAMemberCall("groupBy") and
	pred = call.getArgument(0) and
	(succ = call.getCallback(1).getParameter(0) or succ = call)
	)
	}
	}

Is there a reason for having these two implementations for Map.groupBy?

Happy to update to your suggestion if you feel that's the best solution. We should add tests for the lodash library, though; they are currently very minimal.

[nicolaswill]

@asgerf Are there changes needed here? Merging this PR as well as #19770 is important for a customer.