Python: model PyMongo collection reads as database sources - #22812

PyMongo collection reads are not currently modeled as sources under the opt-in database threat model. As a result, py/sql-injection misses stored document values that are subsequently concatenated into SQL, including the list accumulation and str.join example in #21775.

This adds a ThreatModelSource for the existing MongoCollectionCall model, following the database source convention used by PEP 249 fetch methods. It covers the already-modeled PyMongo and Flask-PyMongo collection read APIs and collection access paths. Sources become active when database, local, or all is enabled; the default remote threat model is unchanged.

Related to #21775.

Validation

• On unmodified main at 4af6ba60e60683f482a583f9d444f1286abafd1f, the new SQL fixture produced zero alerts with the database threat model enabled. With this change, it produces exactly eight alerts at the intended unsafe SQL constructions.
• Parameterized SQL using the same stored values, write/count results, and an unrelated class with a find_one method are covered as negative cases. Library tests cover collection access variants, legacy find_and_modify, and Flask-PyMongo; a separate query verifies that database sources are inactive by default.
• CodeQL CLI 2.27.2: all nine focused query/library tests passed, including the existing SQL injection, local threat model, NoSQL injection, PEP 249/psycopg, and default threat model tests. QL formatting and git diff --check passed.

The focused test command was:

codeql test run --search-path=. --threads=2 --ram=4096 \
  python/ql/test/library-tests/frameworks/pymongo \
  python/ql/test/query-tests/Security/CWE-089-SqlInjection-database-threat-model \
  python/ql/test/query-tests/Security/CWE-089-SqlInjection \
  python/ql/test/query-tests/Security/CWE-089-SqlInjection-local-threat-model \
  python/ql/test/query-tests/Security/CWE-943-NoSqlInjection \
  python/ql/test/library-tests/frameworks/psycopg \
  python/ql/test/library-tests/threat-models/default

AI assistance was used for implementation and test development. The validation described above was executed locally. The complete Python test suite was not run.