Fix a regression where the alert was not made if a child CQL clause is tainted

For example, this example was not alerted on:

``` javascript
  this.on("send00234", async (req) => {
    const { id } = req.data;
    const { Service1Entity } = this.entities;
    await UPDATE.entity(Service1Entity).set("col1 = col1 + " + id).where`ID = ${id}`;  // UNSAFE: direct concatenation with `+`
  });
```

Author: jeongsoolee09

javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CAPCqlInjectionQuery.qll

@@ -36,15 +36,20 @@ class AwaitCqlClauseWithStringConcatParameter extends CqlInjectionSink {
   DataFlow::Node queryParameter;
   DataFlow::Node query;
   CqlClauseWithStringConcatParameter cqlClauseWithStringConcat;
+  CqlClause finalAncestorCqlClauseOfCqlClauseWithStringConcat;
 
   AwaitCqlClauseWithStringConcatParameter() {
     exists(AwaitExpr await |
       this = await.flow() and
-      await.getOperand() = cqlClauseWithStringConcat.(CqlClause).asExpr()
+      await.getOperand() = finalAncestorCqlClauseOfCqlClauseWithStringConcat.asExpr() and
+      finalAncestorCqlClauseOfCqlClauseWithStringConcat =
+        cqlClauseWithStringConcat.(CqlClause).getFinalClause()
     )
   }
 
-  override DataFlow::Node getQuery() { result = cqlClauseWithStringConcat.(CqlClause).flow() }
+  override DataFlow::Node getQuery() {
+    result = finalAncestorCqlClauseOfCqlClauseWithStringConcat.flow()
+  }
 }
 
 /**
@@ -189,7 +194,7 @@ class CqlInjectionConfiguration extends TaintTracking::Configuration {
 
     exists(CqlClause cqlClause |
       start = cqlClause.getArgument().flow().getAPredecessor*().(StringOps::Concatenation) and
-      end = cqlClause.flow()
+      end = cqlClause.getFinalClause().flow()
     )
   }
 }

javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CQL.qll

@@ -264,6 +264,17 @@ class CqlClause extends TCqlClause {
 
   predicate isFinal() { not exists(this.getParentCqlClause()) }
 
+  /**
+   * Gets the final CQL clause that this clause is a part of.
+   */
+  CqlClause getFinalClause() {
+    if this.isFinal()
+    then result = this
+    else (
+      result = this.getAnAncestorCqlClause() and result.isFinal()
+    )
+  }
+
   /**
    * Matches the given `CqlClause` to its method/property name, nested at arbitrary depth.
    */