Added test case @apollo/server with SSRF.

javascript/ql/test/query-tests/Security/CWE-918/apollo.serverSide.ts

@@ -0,0 +1,14 @@
+import { ApolloServer } from '@apollo/server';
+import { get } from 'https';
+
+function createApolloServer(typeDefs) {
+    const resolvers = {
+        Mutation: {
+          downloadFiles: async (_, { files }) => { // $ MISSING: Source[js/request-forgery]
+            files.forEach((file) => { get(file.url, (res) => {}); }); // $ MISSING: Alert[js/request-forgery] Sink[js/request-forgery]
+            return true;
+          },
+        },
+      };
+    const server = new ApolloServer({typeDefs, resolvers});
+}