add explanations about modulo by power of 2

javascript/ql/src/Security/CWE-327/BadRandomness.ql

@@ -99,6 +99,7 @@ DataFlow::Node badCrypto(string description) {
     description = "modulo" and
     goodRandom() = random and
     random.flowsToExpr(mod.getLeftOperand()) and
+    // division by a power of 2 is OK. E.g. if `x` is uniformly random is in the range [0..255] then `x % 32` is uniformly random in the range [0..31]. 
     not mod.getRightOperand().getIntValue() = [2, 4, 8, 16, 32, 64, 128] and
     // not exists a comparison that checks if the result is potentially biased.
     not exists(BinaryExpr comparison | comparison.getOperator() = [">", "<", "<=", ">="] |

javascript/ql/test/query-tests/Security/CWE-327/bad-random.js

@@ -7,7 +7,7 @@ const buffer = crypto.randomBytes(bytes);
 const digits = [];
 for (let i = 0; i < buffer.length; ++i) {
     digits.push(Math.floor(buffer[i] / 25.6)); // NOT OK
-    digits.push(buffer[i] % 8); // OK - 8 is a power of 2, so the result is unbiased.
+    digits.push(buffer[i] % 8); // OK - input is a random byte, so the output is a uniformly random number between 0 and 7. 
     digits.push(buffer[i] % 100); // NOT OK
 }