fix(scan,taint): TypeScript's limit is owned by TypeScript; a source pattern is a token

Two defects found by the cause-B rescan of the independent population (exploratory,
a retune after protocol-v1):

- `typescript_property_support_unvalidated` still reached the whole repository.
  YesWiki is a PHP application that ships a few `.ts` files, and all 1,128 of its PHP
  questions were unresolved. The limit is now owned by the TypeScript partition. A
  TypeScript project (Mockoon, Signal K) is unchanged.
- `isSourceCall`, and the method-level "reads a source" heuristics, matched source
  patterns as substrings. Flask's `request.get` therefore claimed Django's
  `request.get_host()`. wger's fix passes that host to
  `url_has_allowed_host_and_scheme`, and both fixed functions were reported as open
  redirects from it. Patterns are now matched as bounded tokens, like sinks and
  sanitizers. wger's vulnerable-pin detections rest on `request.GET`, which still
  matches.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

src/openultrasast/model/partitions.py

@@ -279,6 +279,9 @@ def build_partitions(
             if language == "typescript":
                 record_limits += ("typescript_property_support_unvalidated",)
                 boundaries.add("typescript_property_support_unvalidated")
+                # About TypeScript answers. YesWiki is a PHP application that ships a few `.ts` files, and this
+                # boundary made all 1,128 of its PHP questions unresolved.
+                owned_languages.setdefault("typescript_property_support_unvalidated", set()).add("typescript")
             if language in {"c", "cpp"}:
                 record_limits += ("c_bounds_arithmetic_unmodeled",)
             records.append(