Address FN involving CAP remote flow sources

[jeongsoolee09]

What This PR Contributes

This PR fixes false negative cases where the current CAP remote flow source definition UserProvidedPropertyReadOfHandlerParameterOfExposedService is missing detections from the code that comes in the following form:

import cds from "@sap/cds";

module.exports = (srv) => { srv.on(...) }

Two things are notable in the above case:

1. The code is mixing ES2015 modules and CommonJS modules with regards to importing and exporting values.
2. The service is implemented in a form of a function (or closure) exported by this module.

Unfortunately, the CodeQL Standard Library for JavaScript cannot detect the above (srv) => { srv.on(...) } element due to some limitations (see issue #221). Therefore, we directly describe the above pattern module.exports = (...) => { ... } as a hack around it.

Other than that, the code changes include:

• Extension to definitions:
  • Add an explicit case named ExportedClosureApplicationServiceDefinition of a UserDefinedApplicationService that is defined in the form of an exported function whose first parameter represents the service instance.
  • Add a definition ServiceInstanceFromExportedClosureParameter that matches above class.
• Bug fixes:
  • Address a bug in the UserDefinedApplicationService.isExposed/0 where a simple negation also captured cases where CDS declarations were missing.
  • Address a bug in the HandlerParameterOfExposedService where the trailing .getCdsDeclaration() was missing.

Future Works

Remove the "hack around it" once the relevant portion of the library is patched and released.