Java: Taint flows backwards for array element

### Version
```
CodeQL extension version: 1.12.0
CodeQL CLI version: 2.15.5
Platform: win32 x64
```

Dependencies:
- `codeql/java-all: 0.8.5`

### Description
It looks like taint tracking erroneously reports that taint flows "backwards" from an array element assignment.
For example:
```java
void arrayAssign() {
String[] s = {"a"};
s[0] = source(sink(s[0]));
}
```

Here it erroneously reports that there is taint flow from `source` to `sink`, even though `sink` is actually executed _before_ `source`, so there should not be any flow between them.

Here is also real world code where this occurs: [apache/logging-log4j2](https://github.com/apache/logging-log4j2/blob/e7b107fe44fd18ca759b83f0cbdb37bc889233f4/log4j-1.2-api/src/test/java/org/apache/log4j/layout/Log4j1SyslogLayoutTest.java#L63-L64)
(my query considered the output of `String.format` as source, and an argument to `String.format` as sink)

### Steps to reproduce
Java code:
```java
class FlowTest {
T source(T o) {
return o;
}

T sink(T o) {
return o;
}

void varAssign() {
String s = "a";
s = source(sink(s));
}

void arrayAssign() {
String[] s = {"a"};
// Erroneously reports flow from `source` to `sink`
s[0] = source(sink(s[0]));
}
}
```

CodeQL query:
```codeql
/**
* @kind problem
*/

import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking

class Source extends DataFlow::Node {
Source() {
exists(Method m |
m = this.asExpr().(MethodCall).getMethod().getSourceDeclaration() and
m.hasName("source") and
m.fromSource()
)
}
}

class Sink extends DataFlow::Node {
Sink() {
exists(MethodCall call, Method m |
call.getAnArgument() = this.asExpr() and
m = call.getMethod().getSourceDeclaration() and
m.hasName("sink") and
m.fromSource()
)
}
}

from Source source, Sink sink, string type
where
type = "dataflow" and DataFlow::localFlow(source, sink)
or
type = "taint" and TaintTracking::localTaint(source, sink)
select sink, type + " from $@", source, "source"
```

Reproduce the issue with the supplied FlowTest Java code and CodeQL query, comparing DataFlow::localFlow with TaintTracking::localTaint. Start by tracing the imported semmle.code.java.dataflow.DataFlow and TaintTracking library entry points, then verify the array assignment handling. Done means taint no longer flows from source to the earlier sink while the variable-assignment example remains correct.

由索引模型根據 Issue 內容生成。