include startsWith/endsWith checks in js/missing-origin-check

javascript/ql/test/query-tests/Security/CWE-020/MissingOriginCheck/tst.js

@@ -61,4 +61,10 @@ function is_valid_origin(origin) {
         warn("invalid origin: " + origin);
     }
     return valid;
-}
+}
+
+window.onmessage = event => { // OK - the check is OK
+    if ("https://www.example.com".startsWith(event.origin)) {
+      // do something
+    }
+}