JS: Added support for fastify.addHook

[Napalys]

The following pull-request adds support for fastify's addHook method.

[Copilot]

Pull Request Overview

This PR adds support for Fastify's addHook method to expand CodeQL's query tests for code injection vulnerabilities. Key changes include:

• Introducing test cases for various Fastify hook events using eval on request query parameters.
• Adding a corresponding model extension in fastify.model.yml.
• Updating change notes to document added support for addHook.

Reviewed Changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated 1 comment.

File	Description
javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/fastify.js	Adds multiple hook examples that demonstrate code injection scenarios via eval.
javascript/ql/lib/ext/fastify.model.yml	Introduces a model extension mapping for the fastify addHook method.
javascript/ql/lib/change-notes/2025-04-14-fastify-addhook.md	Documents the minor analysis change for fastify addHook support.

Files not reviewed (2)

• javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected: Language not supported
• javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected: Language not supported

[asgerf]

Looking at the latest DCA run, it looks like we spuriously mark the return value of addHook as a reflected XSS sink. Could you update ResponseSendArgument in Fastify.qll to exclude addHook?