JS: Add view-component-input threat model

[asgerf]

We sometimes get requests from users to treat React props, Vue props, or Angular inputs as taint sources. Such inputs are not true taint sources however, and tend to generate many false positives in practice if used as taint sources. These inputs are akin to function parameters in that they just hold whatever values are passed in at the component's instantiation site.

As a middle ground, this PR adds a new threat model kind called view-component-input. When enabled, React props, Vue props, and Angular2 inputs are seen as taint sources.

Also adds a new meta-query to report changes to threat model sources other than remote.

Evaluations:

• Evaluation (underway)
• Evaluation of just the type-restricting commit shows a couple of sources of type boolean or number gets filtered out.