JS: More precise model of .shift()

Array.prototype.shift only returns the first array element.

The mutation of Argument[this] is not yet modelled, and is better handled when we have use-use flow.

Author: asgerf

javascript/ql/lib/semmle/javascript/internal/flow_summaries/Arrays.qll

@@ -484,7 +484,7 @@ class Shift extends SummarizedCallable {
 
   override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
     preservesValue = true and
-    input = "Argument[this].ArrayElement" and
+    input = "Argument[this].ArrayElement[0]" and
     output = "ReturnValue"
   }
 }