JS: Add CWE tags for ML-powered queries

- Cross-site scripting: CWE-79
- Path injection: CWE-22, CWE-23, CWE-36, CWE-73, CWE-99
- NoSQL injection: CWE-943
- SQL injection: CWE-89

Author: henrymercer

javascript/ql/experimental/adaptivethreatmodeling/src/NosqlInjectionATM.ql

@@ -10,6 +10,7 @@
  * @security-severity 8.8
  * @id js/ml-powered/nosql-injection
  * @tags experimental security
+ *       external/cwe/cwe-943
  */
 
 import ATM::ResultsInfo

javascript/ql/experimental/adaptivethreatmodeling/src/SqlInjectionATM.ql

@@ -10,6 +10,7 @@
  * @security-severity 8.8
  * @id js/ml-powered/sql-injection
  * @tags experimental security
+ *       external/cwe/cwe-089
  */
 
 import experimental.adaptivethreatmodeling.SqlInjectionATM

javascript/ql/experimental/adaptivethreatmodeling/src/TaintedPathATM.ql

@@ -10,6 +10,11 @@
  * @security-severity 7.5
  * @id js/ml-powered/path-injection
  * @tags experimental security
+ *       external/cwe/cwe-022
+ *       external/cwe/cwe-023
+ *       external/cwe/cwe-036
+ *       external/cwe/cwe-073
+ *       external/cwe/cwe-099
  */
 
 import ATM::ResultsInfo

javascript/ql/experimental/adaptivethreatmodeling/src/XssATM.ql

@@ -10,6 +10,7 @@
  * @security-severity 6.1
  * @id js/ml-powered/xss
  * @tags experimental security
+ *       external/cwe/cwe-079
  */
 
 import javascript