Python: Add taint flow through list.extend and list.insert

[Copilot]

CodeQL's Python taint tracking propagated through list.append but not through list.extend, list.insert, or +=, causing security queries (e.g. CommandInjection.ql) to silently miss flows that differ only in which list-mutation idiom is used.

acc = []
acc.extend([user])       # not reported
acc.insert(0, user)      # not reported
subprocess.call(acc[0], shell=True)

Flow summaries

• Added ListExtend flow summary in python/ql/lib/semmle/python/frameworks/Stdlib.qll: propagates element content from the argument's ListElement/SetElement/AnyTupleElement into the receiver's ListElement, plus a blunt taint fallback — same shape as the existing ListAppend/ListSummary/SetSummary models.
• Added ListInsert flow summary: propagates the inserted value into the receiver's ListElement, plus a blunt taint fallback.

Tests

• test_collections.py: list_extend() now asserts tainted (previously MISSING); added list_extend_iteration() and list_insert() covering the new summaries.
• test_builtins.py: added precise flow-label tests for list.extend and list.insert.

Known remaining gap: +=

acc += [user] still isn't tracked. It desugars to Python's + operator, handled by the shared concatStep, which is a global additional taint step — the shared dataflow library deliberately withholds "implicit content read" privileges from such global steps (only sinks and locally-defined config steps get them), so a list value flowing through + isn't unwrapped to see its tainted content. Fixing this properly needs new content-aware store/read steps for binary + in the core dataflow library, a materially larger change than a library flow summary. This is left as a documented MISSING test case (list_iadd()), consistent with the pre-existing, similarly-unaddressed dict | merge gap in the same test file.

• Fixes Python: taint is lost through list.extend, list.insert and += , but not list.append #22305