Phase 1 (#33)

* chore: Exclude CLAUDE.md from Cargo.toml

* feat: add callgraph module and integrate into main analysis flow

* feat: enhance CLI with new severity filtering and analysis modes

* feat: update CHANGELOG with recent enhancements and fixes to severity filtering and output handling

* feat: implement state-model dataflow analysis for resource lifecycle and auth state

* feat: enhance diagnostic output formatting and add evidence structure

* feat: implement attack surface ranking for diagnostics with scoring and sorting

* feat: add comprehensive documentation for installation, usage, and rules reference

* feat: add multiple language support for command execution and evaluation endpoints

* feat: implement inline suppression for findings using `nyx:ignore` comments

* feat: add confidence levels to AST patterns and update output structure

* feat: implement low-noise prioritization system with category filtering, rollup grouping, and configurable budgets

* feat: bump version to 0.4.0 and update changelog with new features and improvements

* feat: add dead code allowances to various functions in mod.rs and real_world_tests.rs

tests/fixtures/patterns/javascript/negative.js

@@ -0,0 +1,25 @@
+// Negative fixture: none of these should trigger security patterns.
+
+function safeStringOps() {
+    var x = "hello";
+    var y = x.toUpperCase();
+    var z = JSON.stringify({ key: "value" });
+}
+
+function safeTimeout(fn) {
+    // Function reference, not string
+    setTimeout(fn, 1000);
+}
+
+function safeDomManipulation(el) {
+    el.textContent = "safe text";
+    el.setAttribute("class", "active");
+}
+
+function safeRandomness() {
+    var buf = crypto.getRandomValues(new Uint8Array(16));
+}
+
+function safeCopy(src) {
+    var copy = Object.assign({}, src);
+}

tests/fixtures/patterns/javascript/positive.js

@@ -0,0 +1,51 @@
+// Positive fixture: each snippet should trigger the named pattern.
+
+// js.code_exec.eval
+function triggerEval(code) {
+    eval(code);
+}
+
+// js.code_exec.new_function
+function triggerNewFunction(body) {
+    var fn = new Function(body);
+}
+
+// js.code_exec.settimeout_string
+function triggerSetTimeout() {
+    setTimeout("alert(1)", 1000);
+}
+
+// js.xss.document_write
+function triggerDocumentWrite(data) {
+    document.write(data);
+}
+
+// js.xss.outer_html
+function triggerOuterHtml(el, data) {
+    el.outerHTML = data;
+}
+
+// js.xss.insert_adjacent_html
+function triggerInsertAdjacentHtml(el, data) {
+    el.insertAdjacentHTML("beforeend", data);
+}
+
+// js.prototype.proto_assignment
+function triggerProtoAssignment(obj) {
+    obj.__proto__ = { malicious: true };
+}
+
+// js.xss.location_assign
+function triggerLocationAssign(url) {
+    window.location = url;
+}
+
+// js.xss.cookie_write
+function triggerCookieWrite(sid) {
+    document.cookie = "session=" + sid;
+}
+
+// js.crypto.math_random
+function triggerMathRandom() {
+    var token = Math.random();
+}