Java: File constructor path sanitizer

[jcogs33]

Adds a path injection sanitizer for the child argument of a java.io.File constructor when that argument is normalized or checked for the absence of "..".

Pull Request checklist

All query authors

• A change note is added if necessary. See the documentation in this repository.
• QL tests are added if necessary. See Testing custom queries in the GitHub documentation.

Internal query authors only

• Changes are validated at scale (internal access required).