Java: CodeQL does not detect SSL certificate validation vulnerabilities in Apache HttpComponents

**Description of the issue**

Java code vulnerabilities that trust self-signed certificates for outbound HTTP requests are not detected by CodeQL. In other words, CWE-295 is not detected for self-signed certificates when the [Apache HttpComponents HttpClient](https://hc.apache.org/httpcomponents-client-4.5.x/index.html) is used.

Apache HttpComponents is listed as a supported framework in the [CodeQL documentation](https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/).

**Code samples or links to source code**
Refer to https://github.com/ebickle/codeql-security-selfsigned for a narrowly scoped example of the issue using HTTPClient 4.5 and `TrustSelfSignedStrategy`.

Some sample code is also included here:
```
KeyStore javaKeyStore = KeyStore.getInstance(KeyStore.getDefaultType());

SSLContext sslContext = SSLContexts.custom()
.loadTrustMaterial(null, new TrustSelfSignedStrategy())
.build();

HttpClientBuilder httpClientBuilder = HttpClientBuilder.create()
.setSSLContext(sslContext);

try (CloseableHttpClient httpClient = httpClientBuilder.build()) {
HttpGet request = new HttpGet("https://github.com/");
try (CloseableHttpResponse response = httpClient.execute(request)) {
System.out.println(response.getStatusLine().getReasonPhrase());
}
}
```

Based on a review of the `java-queries` and `java-all` qlpacks, it appears as though CodeQL isn't checking for any vulnerabilities where SSL certificate verification is disabled, except for the built-in Java SE platform classes. Apache HttpComponents is so broadly used that CodeQL should probably add additional checks targeting these libraries (and the various incompatible versions of it - e.g. v3.x, v4.x, v5.x).

There are a few different insecure configurations possible - the sample code above just covers self-signed certificates, but not completely disabling certificate validation or other common scenarios. The `TrustSelfSignedStrategy` was caught by our third-party scanning tool that we're deprecating, but not by CodeQL.

Reproduisez le problème avec l’exemple codeql-security-selfsigned lié, puis examinez les qlpacks java-queries et java-all à la recherche de vérifications existantes de validation des certificats SSL. Comparez l’utilisation d’Apache HttpComponents 4.5 avec les cas Java SE pris en charge et examinez la couverture des configurations non sécurisées associées. Le travail est considéré comme terminé lorsque la vulnérabilité de l’exemple concernée et les cas de test appropriés sont détectés.

Rédigé par le modèle d'indexation à partir du texte de l'issue.