Bind captured type-tracking jumps from their source

The previous capturedJumpStep shape introduced an independent
Cfg::DefinitionNode and related it to the captured variable before nodeTo
bound the relevant scope-entry definition. On substantial databases, the
evaluator chose a plan that materialized a high-duplication store/variable
join before applying the target entry and source-node constraints.

Bind the scope-entry definition from nodeTo first, derive its source variable,
and then match nodeFrom's DefinitionNode directly to that variable's store.
This is relation-equivalent existential elimination: the old
nodeFrom.asCfgNode() = def and def.getNode() = store constraints become
nodeFrom.asCfgNode().(Cfg::DefinitionNode).getNode() = store, preserving the
DefinitionNode type restriction and the unchanged enclosing-scope condition.

On Airflow a9da0f7 with CodeQL 2.26.2, against exact #21925 head
1a8e317:

* The call-target diagnostic retains the identical 59,732-edge set while
  tuples joined fall from 1,032,403,207 to 66,969,953 (-93.5%), maximum
  duplication falls from 1,473,981 to 4,053, and evaluator wall time falls
  from 59.9s to 6.2s.
* py/clear-text-logging-sensitive-data retains every result tuple (130 alerts,
  256,708 path edges, 102,385 path nodes, and 116,976 subpaths) while tuples
  joined fall from 1,329,594,809 to 242,111,554 (-81.8%) and evaluator wall
  time falls from 94s to 14.4s.

The preceding commit is intentionally a semantic call-target invariant
diagnostic that passes on the unoptimized relation and after this rewrite. An
inline MISSING/SPURIOUS red-state would assert an artificial semantic delta;
this optimization must preserve every valid captured call target.

These measurements cover one exact substantial Airflow database and two query
shapes. No DCA was run, the fix does not reduce legitimate call-graph or path
growth, and broader fleet performance remains to be confirmed separately.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5dfda5f5-08c8-481b-9ecb-299018701497

Author: yoff

python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackingImpl.qll

@@ -323,14 +323,10 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
     //
     // nodeFrom is `expr`
     // nodeTo is entry node for `f`
-    exists(
-      SsaImpl::ScopeEntryDefinition e, SsaImpl::SsaSourceVariable var, Cfg::DefinitionNode def
-    |
-      e.getSourceVariable() = var and
-      def.getNode() = var.getVariable().getAStore()
-    |
+    exists(SsaImpl::ScopeEntryDefinition e, SsaImpl::SsaSourceVariable var |
       nodeTo.(DataFlowPublic::ScopeEntryDefinitionNode).getDefinition() = e and
-      nodeFrom.asCfgNode() = def and
+      e.getSourceVariable() = var and
+      nodeFrom.asCfgNode().(Cfg::DefinitionNode).getNode() = var.getVariable().getAStore() and
       var.getVariable().getScope().getScope*() = nodeFrom.getScope()
     )
   }