JavaScript: Functions flowing through arrays

Taint analysis seems to not work for arrays:
```js
const fs = require('fs')

function readFileHelper(p) {
fs.readFile(p) // <- detected
}

function readFileHelper2(p) {
fs.readFile(p) // <- not detected
}

const reads = [
readFileHelper2
]

const v = process.argv[2];

readFileHelper(v) // work
const res = reads.map(d => d(v)); // not working
for (let d of reads) {
d(v); // not working
}
reads[0](v); // not working
[readFileHelper2].map(d => d(v)); // not working
```
```ql
import javascript

class CommandLineFileNameConfiguration extends TaintTracking::Configuration {
CommandLineFileNameConfiguration() { this = "CommandLineFileNameConfiguration" }

override predicate isSource(DataFlow::Node source) {
DataFlow::globalVarRef("process").getAPropertyRead("argv").getAPropertyRead() = source
}

override predicate isSink(DataFlow::Node sink) {
DataFlow::moduleMember("fs", "readFile").getACall().getArgument(0) = sink
}
}

from CommandLineFileNameConfiguration cfg, DataFlow::Node source, DataFlow::Node sink
where cfg.hasFlow(source, sink)
select source, sink
```
It found `readFileHelper` but not `readFileHelper2`.

There is related issue https://github.com/github/codeql/issues/5177

Pinging gently @erik-krogh

Start by running the supplied JavaScript reproducer with CommandLineFileNameConfiguration and compare the direct call with map, loop, indexed, and inline-array calls. Read the JavaScript DataFlow and TaintTracking entry points used by DataFlow::Node and hasFlow, with related issue #5177 as context. Done means the query reports the expected flows through these array patterns.

Vom Indexierungsmodell aus dem Issue-Text verfasst.