Don't flag header injection as XSS.

All results I have seen from this are uninteresting.

change-notes/1.24/analysis-go.md

@@ -10,3 +10,4 @@
 
 | **Query**                                           | **Expected impact**          | **Change**                                                |
 |-----------------------------------------------------|------------------------------|-----------------------------------------------------------|
+| Reflected cross-site scripting (`go/reflected-xss`) | Fewer results | Untrusted input flowing into an HTTP header definition is no longer flagged, since this is often harmless. |

ql/src/semmle/go/security/ReflectedXssCustomizations.qll

@@ -51,11 +51,6 @@ module ReflectedXss {
     )
   }
 
-  /**
-   * An expression that is sent as part of an HTTP header, considered as an XSS sink.
-   */
-  class HttpResponseHeaderSink extends Sink, HTTP::Header { }
-
   /**
    * A third-party controllable input, considered as a flow source for reflected XSS.
    */

ql/test/query-tests/Security/CWE-079/contenttype.go

@@ -26,6 +26,8 @@ func serve3() {
 		w.Header().Set("Content-Type", "text/plain")
 
 		w.Write([]byte(data)) // OK; no script can be executed from a `text/plain` context.
+
+		w.Header().Set("X-My-Custom-Header", data) // OK; injecting headers is not usually dangerous
 	})
 	http.ListenAndServe(":80", nil)
 }