Enhance the dataflow sink and update test cases

java/ql/src/semmle/code/java/security/SensitiveActions.qll

@@ -27,6 +27,14 @@ private string nonSuspicious() {
   result = "%crypt%"
 }
 
+/**
+ * Gets a regular expression for matching common names of variables that indicate the value being held contains sensitive information.
+ */
+string getCommonSensitiveInfoRegex() {
+  result = "(?i).*challenge|pass(wd|word|code|phrase)(?!.*question).*" or
+  result = "(?i).*(token|username|userid|secret).*"
+}
+
 /** An expression that might contain sensitive data. */
 abstract class SensitiveExpr extends Expr { }