Python: Add unsafe deserialization sinks (CWE-502)

[maikypedia]

This pull request adds sinks for unsafe deserialization covering pandas, numpy and joblib.

[RasmusWL]

Thanks for this high quality submission @maikypedia 👍

I've made a few minor changes, but overall everything looked good 🙌

(I'll just take a look at new results before merging 👍)

[RasmusWL]

I looked over some of the new sinks we get from this (results) -- we get quite a few cases where it's clearly a path being passed to one of the new sinks, such as in the example below.

np.load(os.path.join(graph_work_path, "train_data.npy"), allow_pickle=True)

In those cases, it becomes tricky. If user can control the data being loaded, it could still lead to arbitrary code execution through deserialization. It's a little unclear whether to treat this under the path-injection query or not, since the normal rules for a safe path doesn't necessarily apply here (path restricted to specific folder) 🤔

let me be clear: It's not something I would expect you to have solved @maikypedia, just an interesting observation we (CodeQL team) can consider how to approach.