We sometimes get requests from users to treat React props, Vue props, or Angular inputs as taint sources. Such inputs are not true taint sources however, and tend to generate many false positives in practice if used as taint sources. These inputs are akin to function parameters in that they just hold whatever values are passed in at the component's instantiation site.

As a middle ground, this PR adds a new threat model kind called view-component-input. When enabled, React props, Vue props, and Angular2 inputs are seen as taint sources.

Also adds a new meta-query to report changes to threat model sources other than remote.

Evaluations:

• Evaluation with threat model turned on shows 14k new taint sources and 283 new alerts. I haven't found any TPs in the new alerts.
• Evaluation of just the type-restricting commit shows a couple of sources of type boolean or number gets filtered out.