fix(java/jdo-sqli): detect String.formatted() as a tainted query source

[rayair250-droid]

Closes #3812.

Problem

java/lang/security/audit/sqli/jdo-sqli flags a formatted/concatenated string passed to JDO query APIs (setFilter/setGrouping/newQuery). It already handles String.format(...) and $X + $Y concatenation, but misses the Java 15+ instance method "...".formatted(input), which produces the exact same attacker-controlled query string:

q.setFilter("id == %s".formatted(filterValue));               // was NOT flagged
pm.newQuery(UserEntity.class, "id == %s".formatted(input));   // was NOT flagged

Reproduction scanned with 0 findings before this change — a SQL-injection false negative.

Fix

Mirror the existing String.format(...) handling with "...".formatted(...) patterns, in both the Query and PersistenceManager branches — as a pattern-inside source (String $SQL = "...".formatted(...);) and as a direct argument ($Q.$METHOD("...".formatted(...),...) / $PM.newQuery(...,"...".formatted(...),...)).

Added // ruleid: test cases for the new patterns. semgrep --test reports All tests passed (existing // ok: cases still don't match).

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}