Fix location property for taint operations (fixes #321)

[eleumasc]

In this pull request, we propose a solution for the empty taint location issue involving XMLHttpRequest.response, or better, string literals in dynamically evaluated tainted scripts. Moreover, we fix empty taint locations for fetch.text() and fetch.json() taint operations, including those in JSON.parse taint operations. Hence, this pull request fixes #321.

First, we add nlohmann/json (taint/json.hpp), a popular and maintained library for JSON parsing and serialization. We decided to add it because Firefox internals only provide JSONWriter, not JSONReader, and the JSON features provided by the JS engine require a JSContext*. Update: we discovered that it is possible to instantiate an ad-hoc JSContext* for JSON parsing and serialization, however we maintained the implementation from #338.
Then, in Taint.h we declare the functions ParseStringTaint and SerializeStringTaint to parse and serialize, respectively, the whole StringTaint data structure as a simplified JSON string. Their implementation in Taint.cpp is based on nlohmann/json.
Finally, in Taint.h we replace the functions ParseTaint with ParseStringTaintForE2E and serializeStringtaint with SerializeStringTaintForE2E for the end-to-end tainting. We rewrite the functions using nlohmann/json and thus discarding the custom JSON parser, while preserving the expected behavior of these functions.

To fix empty taint locations for fetch.text() and fetch.json() taint operations, we add an additional attribute to the JSContext struct, that we call fallbackTaintLocation. On TaintLocationFromContext, if it is not possible to create the TaintLocation from the given context, we get it from the fallbackTaintLocation. In this pull request, fallbackTaintLocation is set in the main thread, before BodyConsumer created by fetch logic is executed in another thread.

Other

• Formatted jstaint.{cpp,h}.
• Fixed naming and typing for TaintOperation::source and TaintOperation::native.
• Added request URL argument to XMLHttpRequest.response(json) taint operation (see Network taint operations miss arguments about the request #320).

Differences from #338

• Reverted format String.cpp.
• Changed naming of DumpStringTaintAsJSON, LoadStringTaintFromJSON, etc. to avoid ambiguities.
• Fixed empty taint locations for fetch.text() and fetch.json() taint operations.