JS: Improve handling of React, lodash, function composition, and dynamic imports

[asgerf]

Adds models for React hooks and react-router (react-router-dom), and tracks components through component transformers and lazy loading.

Some drive-by fixes from testing on some React applications:

• The react props taint steps no longer extends ValueNode as this prevented it from propagating into a property pattern (object patterns are value nodes, but not property patterns).
• A bunch of lodash taint steps (almost the entire "string" category)
• A template injection sink for lodash.template (experimental query). Added to justify not having it as a taint step.
• The function composition model now has a public API and distinguishes left-to-right from right-to-left composition.
• Type-tracking steps through dynamic imports (needed for lazy-loaded React components).
  • Historically we did not handle this well due to the module being wrapped in a promise. We have store/load steps for promises now, which worked like a charm 👍
• The TaintSteps metric now includes AdditionalFlowStep steps. They also affect taint-tracking so this seemed easier than having a separate metric for it. (Both sides of the evaluations contain this commit)

Evaluations:

• react_webapps shows a good number of new taint steps and a few new sources.
• Nightly shows a few thousand new taint steps and a slowdown of about 1%, but the slowdown did not reproduce on a double re-run of the slowest slugs.

[erik-krogh]

I like it.

It took a while to chew through, but it looks great.
I just got a few minor comments.

[asgerf]

Evaluation on nightly came back with a median slowdown of about 1%. Could have been worse, but could also be better. Will investigate.

[asgerf]

Double re-run of the 3 slowest slugs shows that the 1% was most likely a fluke. Looking at tuple counts I didn't see anything out of the ordinary either, although I did notice that getAContextInput should probably be restricted a bit.

[esbena]

LGTM. Two optional nits.

I have raised https://github.com/github/codeql-javascript-team/issues/248, which isn't a blocker for this PR.

[esbena]

Nit: this would read more natural if the order of the three disjuncts was in between out, instead of the current out in between.

[esbena]

Suggested change

	// `memo(f)` returns a function behaves as `f` but caches results
	// `memo(f)` returns a function that behaves as `f` but caches results

[asgerf]

Fixed, and also moved the comment closer to where it belongs