Java: Re-factor most queries and tests to use threat models.

java/ql/lib/semmle/code/java/security/RequestForgeryConfig.qll

@@ -37,7 +37,7 @@ deprecated class RequestForgeryConfiguration extends TaintTracking::Configuratio
  */
 module RequestForgeryConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) {
-    source instanceof RemoteFlowSource and
+    source instanceof ThreatModelFlowSource and
     // Exclude results of remote HTTP requests: fetching something else based on that result
     // is no worse than following a redirect returned by the remote server, and typically
     // we're requesting a resource via https which we trust to only send us to safe URLs.