False positive: Full server-side request forgery

**Description of the false positive**

I have seen alerts for "Full server-side request forgery" (id: `py/full-ssrf`), even though the code has a valid mitigation in place. CodeQL also isn't recognizing other valid mitigations for this vulnerability.

For example, given this code:

```python
url = request.url.replace(request.host_url, "my-expected-host-url")

resp = requests.request(
url=url,
)
```

As you can see, this code is already using `request.url.replace` to control the requested URL and ensure that malicious requests cannot manipulate the destination of the request. However, CodeQL does not recognize this method as a valid mitigation for SSRF.

I also tried:

```python
from urllib.parse import urljoin

url = urljoin("my-expected-host-url", request.path)
```

CodeQL does not accept this approach either.

The only approach that CodeQL accepts is string concatenation:

```python
url = "my-expected-host-url" + request.path
```

Having to use string concatenation instead of `urljoin` is not ideal.

py/full-ssrf クエリから始め、request.url.replace と urllib.parse.urljoin を使って報告された Python の例を再現します。それらのアラートを、受け入れられた文字列連結の例と比較し、その後、有効な URL 構築の緩和策が認識され、実際の SSRF 検出結果が抑制されないことを確認します。

索引モデルが issue の本文から書いたものです。