False positive: Full server-side request forgery

**Description of the false positive**

I have seen alerts for "Full server-side request forgery" (id: `py/full-ssrf`), even though the code has a valid mitigation in place. CodeQL also isn't recognizing other valid mitigations for this vulnerability.

For example, given this code:

```python
url = request.url.replace(request.host_url, "my-expected-host-url")

resp = requests.request(
url=url,
)
```

As you can see, this code is already using `request.url.replace` to control the requested URL and ensure that malicious requests cannot manipulate the destination of the request. However, CodeQL does not recognize this method as a valid mitigation for SSRF.

I also tried:

```python
from urllib.parse import urljoin

url = urljoin("my-expected-host-url", request.path)
```

CodeQL does not accept this approach either.

The only approach that CodeQL accepts is string concatenation:

```python
url = "my-expected-host-url" + request.path
```

Having to use string concatenation instead of `urljoin` is not ideal.

Inizia con la query py/full-ssrf e riproduci gli esempi Python segnalati usando request.url.replace e urllib.parse.urljoin. Confronta i relativi avvisi con l’esempio accettato di concatenazione di stringhe, quindi verifica che le mitigazioni valide per la costruzione degli URL vengano riconosciute senza sopprimere i risultati reali di SSRF.

Scritto dal modello di indicizzazione a partire dal testo della issue.