JS: Exclude environment variables from js/regex-injection query by default

[Napalys]

Removes environment variables as default sources for the js/regex-injection query while allowing them to be re-enabled via the "environment" threat model.

[Copilot]

Pull Request Overview

This PR modifies the js/regex-injection query to exclude environment variables as default sources while allowing them to be re-enabled via the "environment" threat model. The change reduces false positives for scenarios where environment variables are considered trusted input.

• Removes environment variables from default sources in the RegExp injection query
• Adds support for re-enabling environment variables through the "environment" threat model
• Updates test cases to verify the new behavior with both enabled and disabled threat models

Reviewed Changes

Copilot reviewed 8 out of 16 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
RegExpInjectionCustomizations.qll	Refactors source detection to exclude environment variables by default and adds conditional environment variable sources
Threat-models-enabled/*	New test files to verify environment variables are detected when threat model is enabled
Threat-models-disabled/RegExpInjection.js	Updates test to reflect that environment variables should not be detected by default
Threat-models-disabled/RegExpInjection.expected	Updates expected results removing environment variable alerts
2025-07-31-regexp-injection-threat-model.md	Documents the change in behavior

[asgerf]

Awesome!