Add interprocedural taint checks for Bandit injection sinks

Normalized profile

What this task asks for

Track user input through variables and calls so Bandit flags injection sinks beyond string literals. Track input taint from Flask request data, `sys.argv`, `input()`, and `os.environ` into security-sensitive sinks. Propagate taint through string construction, calls, multi-hop assignments, nested functions, and import aliases. Treat parameterized query values, numeric conversion, path basenames, shell quoting, and HTML escaping as safe. Add B620 through B624 checks for SQL injection, shell injection, path traversal, SSRF, and XSS sinks. Report every new plugin finding with HIGH severity and MEDIUM confidence.