JS: mark GraphQLObjectType resolvers args as remote sources

[Napalys]

No description provided.

[Copilot]

Pull Request Overview

This PR adds support for treating GraphQL resolver function parameters in GraphQLObjectType as remote sources for security analysis. This enhancement improves code injection detection by recognizing user-controlled data flowing through GraphQL resolvers.

• Adds a new model entry for GraphQLObjectType resolver parameters as remote sources
• Includes a test case demonstrating code injection through GraphQL resolvers
• Updates expected test results to reflect the new security detection capabilities

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
javascript/ql/lib/ext/graph-ql.model.yml	Adds source model for GraphQLObjectType resolver parameters
javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/graph-ql.js	Adds test case with GraphQLObjectType resolver vulnerable to code injection
javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected	Updates expected results to include new code injection detection
javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected	Updates expected results for heuristic code injection detection
javascript/ql/lib/change-notes/2025-09-19-graphql-type-object.md	Documents the enhancement for GraphQLObjectType modeling