feat(taint): Implement intra-procedural taint propagation

[shivasurya]

Implements forward taint analysis for intra-procedural flows.

• Track taint from sources (request.GET, os.getenv) to sinks (eval, exec)
• Assignment & call propagation with confidence decay
• Stdlib integration with hardcoded patterns
• 100% coverage on core algorithm

Stacked on PR #3.

🤖 Generated with Claude Code

[shivasurya]

• Fix intra-procedural vulnerability detection #348
• feat(callgraph): Integrate taint analysis into call graph builder #347
• feat(taint): Implement intra-procedural taint propagation #346 👈 (View in Graphite)
• feat(callgraph): Add def-use chain construction (PR #3) #345
• feat(callgraph): Add Python statement extraction for intra-procedural dataflow #344
• feat(dataflow): Add core data structures for intra-procedural taint analysis #343
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[codecov]

Codecov Report

❌ Patch coverage is 92.42424% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.29%. Comparing base (b6cfaf7) to head (e79e232).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
sourcecode-parser/graph/callgraph/taint.go	92.42%	5 Missing and 5 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #346      +/-   ##
==========================================
+ Coverage   75.93%   76.29%   +0.35%     
==========================================
  Files          50       51       +1     
  Lines        5964     6096     +132     
==========================================
+ Hits         4529     4651     +122     
- Misses       1244     1249       +5     
- Partials      191      196       +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

_{This report is generated by SafeDep Github App}

[shivasurya]

Merge activity

• Nov 4, 1:51 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Nov 4, 1:56 AM UTC: Graphite rebased this pull request as part of a merge.
• Nov 4, 1:57 AM UTC: @shivasurya merged this pull request with Graphite.