fix(rules): Node vm is an eval sink; a package name is not a sink token

mongo-express CVE-2019-10758 passes the request body to vm.runInNewContext. No
injection sink named that call, so the flow was answered and missed. runInNewContext,
runInContext, runInThisContext and compileFunction are now CWE-95 sinks.

Once the file's questions completed, the fixed pin showed a second defect. Every call
on `require('mongodb-query-parser')` has that package name as its full name. The
bounded-token match treats `-` as a boundary, so the name matched the SQL sink
`query`. In a full name, `-` belongs to a package name, so it no longer separates
tokens.

Exploratory (retune after protocol-v1): mongo-express vulnerable pin now detected at
lib/bson.js:60.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

src/openultrasast/ruleset/semantic/javascript.toml

@@ -11,6 +11,15 @@ cwe = "CWE-95"
 calls = ["eval"]
 rule_ids = ["js-eval"]
 
+[[sink]]
+# CWE-95. Node's `vm` module compiles and runs a string exactly as `eval` does -- its own documentation says
+# it is not a security mechanism. mongo-express CVE-2019-10758 is `vm.runInNewContext('doc = eval((' +
+# string + '));')` over a request body, and with only `eval` listed the flow ended at a sink nobody named.
+id = "vm.eval"
+cwe = "CWE-95"
+calls = ["runInNewContext", "runInContext", "runInThisContext", "compileFunction"]
+rule_ids = []
+
 [[sink]]
 id = "exec"
 cwe = "CWE-78"