I've added LDAP as a sink for js/sql-injection (it already has no-sql / graphql injection).

I've basically rewritten the entire thing, but each commit should be a logical step (they were the steps I took while porting).
There are some TODO's in some of the commits.

Evaluation on js/sql-injection looks fine.

(Internal: I'm using this PR to test a dca feature, ignore the backrefs).