False negative: java string concatenation using StringBuilder causing injection

**Description of the issue**

CodeQL correctly detected a Java code issue that involved Java string concatenation being passed to `Runtime.getRuntime().exec("")`. In our case it wasn't exploitable, but it was still dangerous code that needed to be remediated.

**Code samples**
The code (not mine!) looked a bit like like this:
`Process p = Runtime.getRuntime().exec("python " + SCRIPT_PATH + " --file " + inputFile.getAbsolutePath());`

The developer attempted to correct the issue on their own and changed it to this:
```
StringBuilder pythonPath = new StringBuilder();
pythonPath.append("python ").append(SCRIPT_PATH).append(" --file ").append(inputFile.getAbsolutePath());
Process p = Runtime.getRuntime().exec(pythonPath.toString());
```

CodeQL closed the alert as fixed, even though the new code is still vulnerable and logically the same.

It appears as though CodeQL is not properly detecting Java string concatenation vulnerabilities whenever the `StringBuilder` class is used. `StringBuilder` is fairly common, so this results in some risky omissions.

**CodeQL Rule**
Rule ID: java-concatenated-command-line

**Build-Time Environment**
Language: java
Java Distribution: temurin
Java Version: 8 (via `setup-java@v3`)
Java Build Tool: Maven 3.8.2