false positive - Code Scanning - Java - when urlConnection.getInputStream() is not remote user input

**Description of the false positive**

The following is not valid remote user input.

```java
public final class ResourceReader {

public static String read(ClassLoader classLoader, String path, String fileDesc) {
URL resource = classLoader.getResource(path);
if (resource == null) {
throw new IllegalStateException(String.format("Did not find resource '%s' on classpath.", path));
}

URLConnection urlConnection;
try {
urlConnection = resource.openConnection();
} catch (IOException e) {
throw new RuntimeException(String.format("Could not open connection for resource '%s'.", path), e);
}

InputStream inputStream;
try {
inputStream = urlConnection.getInputStream(); // CODEQL FLAGS THIS AS USER INPUT: But it isn't
} catch (IOException e) {
throw new RuntimeException(String.format("Could not get input stream of connection for resource '%s'.", path), e);
}

int length = urlConnection.getContentLength();
if (length > 1024) {
throw new IllegalStateException(String.format("'%s' is larger than 1 KiB.", fileDesc));
}

try (BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream, StandardCharsets.UTF_8), length)) {
return reader.readLine();
} catch (IOException e) {
throw new RuntimeException(String.format("Error while reading input stream for resource '%s'.", path), e);
}
// ignore
}

private ResourceReader() {
}

}
```

`ClassLoader.getResource` can't get an external resource.

```java
@Test
void resourcesGet() throws IOException {
URL resource = ResourcesTest.class.getClassLoader().getResource("https://google.com");
assertNotNull(resource); // This test will fail as resource is null
}
```

I think that if `urlConnection.getInputStream()` comes from a class loader, it shouldn't be considered a valid source.