C++: Add more registry flow sources and COM-related flow summaries

[MathiasVP]

This PR does two mostly unrelated changes in one go:

1. First, we add two local flow sources that I forgot to add in C++: Add flow sources for winreg.h #22242
2. Second, we add taint models for some common Component Object Model (COM) functions.

As part of (1) I also created a subclass of local flow sources called WindowsRegistrySource similar to what C# has. This shouldn't cause any semantic breakage since they're still local flow sources.

Commit-by-commit review recommended.

[Copilot]

🟡 Not ready to approve

Registry value-name flows and wide-character coverage are missing, while the unconstrained StringFromGUID model risks incorrect summaries.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Adds Windows registry-specific flow sources and COM conversion summaries to C++ data-flow modeling.

Changes:

• Introduces WindowsRegistrySource.
• Models RegEnumValueA/W and COM conversion flows.
• Expands related data-flow tests and expectations.

File summaries

File	Description
cpp/ql/lib/ext/Windows.model.yml	Adds registry and COM models.
cpp/ql/lib/semmle/code/cpp/security/FlowSources.qll	Defines the registry source abstraction.
cpp/ql/test/library-tests/dataflow/external-models/windows.cpp	Adds model test cases.
cpp/ql/test/library-tests/dataflow/external-models/steps.expected	Records expected summary steps.
cpp/ql/test/library-tests/dataflow/external-models/sources.expected	Records registry source classifications.
cpp/ql/test/library-tests/dataflow/external-models/flow.expected	Records generated flow results.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 5
• Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[MathiasVP]

Fixed in 9cf4d07. I have it on good authority that this function exists. But you're right when you say that it's not public. So let's leave it out!

[jketema]

Summary model is still here.

[MathiasVP]

Doh. Good catch. Actually removed in a7c1978

[jketema]

LGTM