Java: CodeQL does not detect SSL certificate validation vulnerabilities in Apache HttpComponents

**Description of the issue**

Java code vulnerabilities that trust self-signed certificates for outbound HTTP requests are not detected by CodeQL. In other words, CWE-295 is not detected for self-signed certificates when the [Apache HttpComponents HttpClient](https://hc.apache.org/httpcomponents-client-4.5.x/index.html) is used.

Apache HttpComponents is listed as a supported framework in the [CodeQL documentation](https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/).

**Code samples or links to source code**
Refer to https://github.com/ebickle/codeql-security-selfsigned for a narrowly scoped example of the issue using HTTPClient 4.5 and `TrustSelfSignedStrategy`.

Some sample code is also included here:
```
KeyStore javaKeyStore = KeyStore.getInstance(KeyStore.getDefaultType());

SSLContext sslContext = SSLContexts.custom()
.loadTrustMaterial(null, new TrustSelfSignedStrategy())
.build();

HttpClientBuilder httpClientBuilder = HttpClientBuilder.create()
.setSSLContext(sslContext);

try (CloseableHttpClient httpClient = httpClientBuilder.build()) {
HttpGet request = new HttpGet("https://github.com/");
try (CloseableHttpResponse response = httpClient.execute(request)) {
System.out.println(response.getStatusLine().getReasonPhrase());
}
}
```

Based on a review of the `java-queries` and `java-all` qlpacks, it appears as though CodeQL isn't checking for any vulnerabilities where SSL certificate verification is disabled, except for the built-in Java SE platform classes. Apache HttpComponents is so broadly used that CodeQL should probably add additional checks targeting these libraries (and the various incompatible versions of it - e.g. v3.x, v4.x, v5.x).

There are a few different insecure configurations possible - the sample code above just covers self-signed certificates, but not completely disabling certificate validation or other common scenarios. The `TrustSelfSignedStrategy` was caught by our third-party scanning tool that we're deprecating, but not by CodeQL.