JavaScript: Refine PasswordInConfigurationFile to avoid FPs.

We now exclude passwords that look like they might be filled in via
templating or shell substitution.

javascript/ql/test/query-tests/Security/CWE-313/tst.yml

@@ -0,0 +1,6 @@
+steps:
+- script: |
+    PASSWORD="$(PASSWORD)" npm install
+    OTHER_PASSWORD=`get password` yarn install
+username: <%= ENV['USERNAME'] %>
+password: <%= ENV['PASSWORD'] %>