Java: CodeQL does not detect SSL certificate validation vulnerabilities in Apache HttpComponents

**Description of the issue**

Java code vulnerabilities that trust self-signed certificates for outbound HTTP requests are not detected by CodeQL. In other words, CWE-295 is not detected for self-signed certificates when the [Apache HttpComponents HttpClient](https://hc.apache.org/httpcomponents-client-4.5.x/index.html) is used.

Apache HttpComponents is listed as a supported framework in the [CodeQL documentation](https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/).

**Code samples or links to source code**
Refer to https://github.com/ebickle/codeql-security-selfsigned for a narrowly scoped example of the issue using HTTPClient 4.5 and `TrustSelfSignedStrategy`.

Some sample code is also included here:
```
KeyStore javaKeyStore = KeyStore.getInstance(KeyStore.getDefaultType());

SSLContext sslContext = SSLContexts.custom()
.loadTrustMaterial(null, new TrustSelfSignedStrategy())
.build();

HttpClientBuilder httpClientBuilder = HttpClientBuilder.create()
.setSSLContext(sslContext);

try (CloseableHttpClient httpClient = httpClientBuilder.build()) {
HttpGet request = new HttpGet("https://github.com/");
try (CloseableHttpResponse response = httpClient.execute(request)) {
System.out.println(response.getStatusLine().getReasonPhrase());
}
}
```

Based on a review of the `java-queries` and `java-all` qlpacks, it appears as though CodeQL isn't checking for any vulnerabilities where SSL certificate verification is disabled, except for the built-in Java SE platform classes. Apache HttpComponents is so broadly used that CodeQL should probably add additional checks targeting these libraries (and the various incompatible versions of it - e.g. v3.x, v4.x, v5.x).

There are a few different insecure configurations possible - the sample code above just covers self-signed certificates, but not completely disabling certificate validation or other common scenarios. The `TrustSelfSignedStrategy` was caught by our third-party scanning tool that we're deprecating, but not by CodeQL.

Reproduce the issue with the linked codeql-security-selfsigned example, then inspect the java-queries and java-all qlpacks for existing SSL certificate validation checks. Compare Apache HttpComponents 4.5 usage with the supported Java SE cases and review coverage for the related insecure configurations. Done means the relevant sample vulnerability and appropriate test cases are detected.

Written by the indexing model from the issue text.