Add option for default taint sanitizer guard

This allows languages to specify A sanitizer guard in all
global taint flow configurations but not in local taint.

Author: owen-mc

java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

@@ -113,6 +113,13 @@ private module Cached {
     node.getEnclosingCallable().getDeclaringType() instanceof NonSecurityTestClass or
     node.asExpr() instanceof ValidatedVariableAccess
   }
+
+  /**
+   * Holds if `guard` should be a sanitizer guard in all global taint flow configurations
+   * but not in local taint.
+   */
+  cached
+  predicate defaultTaintSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
 }
 
 import Cached

java/ql/lib/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll

@@ -93,7 +93,7 @@ abstract class Configuration extends DataFlow::Configuration {
   predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
 
   final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) {
-    this.isSanitizerGuard(guard)
+    this.isSanitizerGuard(guard) or defaultTaintSanitizerGuard(guard)
   }
 
   /**