Supress paths that extend beyond the first sink

For this particular query it's hardly ever interesting to complain about a bad cipher suite being configured, then read from the list and re-added elsewhere. In such a case the longer path will be detected when the shorter one is fixed in any case.

ql/src/experimental/CWE-327/InsecureTLS.ql

@@ -119,6 +119,15 @@ class TlsInsecureCipherSuitesFlowConfig extends TaintTracking::Configuration {
       sink = fld.getAWrite().getRhs()
     )
   }
+
+  /**
+   * Declare sinks as out-sanitizers in order to avoid producing superfluous paths where a cipher
+   * is written to CipherSuites, then the list is further extended with either safe or tainted
+   * suites.
+   */
+  override predicate isSanitizerOut(DataFlow::Node node) {
+    super.isSanitizerOut(node) or isSink(node)
+  }
 }
 
 /**