Java: Add new quality query to detect missing @Nested annotation in JUnit5 tests

[jcogs33]

Description

Adds a new quality query to detect missing @Nested annotations on JUnit 5 inner test classes. This query is migrated from the advance security team's quality queries.

Consideration

Changes from original query. Let me know if you disagree with any of these changes:

• Removed not testClass.isStatic() since the non-static requirement already seemed to be handled by testClass instanceof InnerClass. Let me know if the additional non-static check is needed for some reason I'm not aware of.
• Since inner classes in Java are by definition non-static (c.f. Nested Classes Java docs), I have updated the metadata and other documentation to remove the redundant "non-static" descriptor. This includes updating the query ID and therefore results in the need for a previous ID. Let me know if you think I should keep the original wording instead.
• Added an exclusion for abstract classes since placing an @Nested annotation on abstract classes is invalid and may cause an error. This exclusion reduces the number of alerts on the MRVA top-100 from 5 to 1 and on the MRVA top-1000 from 41 to 29.
• Added exclusions for anonymous, local, and private classes since JUnit seems to define an inner class as non-private, non-anonymous, and non-local. These exclusions further reduce the number of alerts on the MRVA top-100 from 1 to 0 and on the MRVA top-1000 from 29 to 25.
• Included @RepeatedTest, @ParameterizedTest, @TestFactory, and @TestTemplate when identifying JUnit 5 test methods. This inclusion adds 4 more results on the MRVA top-1000.
• Added testability and frameworks/junit metadata tags to align with the tags on the other queries in java/ql/src/Likely Bugs/Frameworks/JUnit.

Questions:

• Should this query have problem.severity of error instead of warning since it results in tests not running correctly?
• I've added this query to the ccr suite. Let me know if I should not add it yet?

Other Notes:

• Autofixes mostly look good, but tries to over-fix in a few cases and misses an import in another case.
• DCA looks good.

[tamasvajk]

LGTM, I have no preference on the problem.severity.

[jcogs33]

I have no preference on the problem.severity.

I'll leave as warning then.

[mchammer01]

@jcogs33 👋🏻 - approving on behalf of Docs ⚡
Left a few minor suggestions, mainly to improve readability.

[owen-mc]

Should we say "query" instead of "rule"?

[jcogs33]

I wondered that as well, but found that there are many pre-existing qhelp files that use the term "rule" (see search results) so I left as-is.

I can change to "query" if anyone feels strongly about it. If we choose to say "query" instead, then we should align on that for all of the ported queries, since I think several say "rule". e.g. java/empty-method

[jcogs33]

Thanks @mchammer01! I've applied your suggestions.

[jcogs33]

cc @knewbury01