investigate TypeScript-ecosystem options for taint analysis

[cfm]

Since we're in a new ecosystem (TypeScript), we should take a look at whether we have new options for taint analysis as one of our code-quality and security checks enforced in CI.

Precedents

• Add annotations for data sources and sinks and further static analysis #385
• Evaluate and implement improvements to code analysis securedrop#6111
• https://github.com/freedomofpress/securedrop-security/issues/43

[cfm]

(Filed based on recent discussions ahead of next week's backlog-pruning session.)