Add com.auth0.jwt.algorithm.Algorithm sinks

The HMAC* constructors of the com.auth0.jwt.algorithm.Algorithm class
take a secret as a parameter. Therefore, the arguments should be added
to be checked for hardcoded credentials.

java/ql/test/experimental/query-tests/security/CWE-321/HardcodedJwtKey.java

@@ -22,7 +22,7 @@ public class HardcodedJwtKey {
                 .withExpiresAt(new Date(new Date().getTime() + ACCESS_EXPIRE_TIME))
                 .withIssuer(ISSUER)
                 .withClaim("username", username)
-                .sign(algorithm);
+                .sign(algorithm); // $ HardcodedCredentialsApiCall
     }
 
     // GOOD: Get secret from system configuration then sign a token
@@ -43,7 +43,7 @@ public class HardcodedJwtKey {
                 .withIssuer(ISSUER)
                 .build();
         try {
-            verifier.verify(token);
+            verifier.verify(token); // $ HardcodedCredentialsApiCall
             return true;
         } catch (JWTVerificationException e) {
             return false;