Added java-kotlin Sensitive Logging barriers (substrings)

[aegilops]

Logging of sensitive data can be mitigated by taking a substring of the data.

This affects the library used by java/sensitive-log (CWE 532).

The exact length suitable will vary by application, but this change takes a conservative approach and allows either substring or take/takeLast of up to 7 characters.

Complex redaction with a regular expression, replacement of particular characters, a substring not at the start or end of the string, or a conditional substring (such as with Apache StringUtils) are not supported in this sanitizer.

There is a new abstraction for sanitizer barriers, along with logic to detect substring operations that restrict logged data to a safe length in both Java and Kotlin code. The existing sanitizers are pulled into a new class called GenericSanitizer, which implements the new abstract class, alongside the new sanitizer.

The safe length restriction must be done in the analyzed code with a compile-time constant integer, but the integer can reach the substring operation using taint.