JavaScript: Switch MissingRateLimiting.qll to API graphs.

The added test shows how this helps us avoid false positives.

javascript/ql/test/query-tests/Security/CWE-770/rateLimit.ts

@@ -0,0 +1,5 @@
+import rateLimit from 'express-rate-limit';
+
+const rateLimitMiddleware = rateLimit();
+
+export default rateLimitMiddleware;

javascript/ql/test/query-tests/Security/CWE-770/tst2.ts

@@ -0,0 +1,8 @@
+import express from 'express';
+import rateLimiter from './rateLimit';
+
+const app = express();
+app.use(rateLimiter);
+app.get('/', (req, res) => {
+    res.sendFile('index.html'); // OK
+});