Add framework and library model plugins #30

Framework plugins enrich the security model; they never detect vulnerabilities themselves.

• Flask: model.http-sources, model.flask-routes (feat: framework models for Flask, FastAPI and SQLAlchemy #31: request sources, Flask.route / Blueprint.route entry points, HTML and path sinks, escape sanitizers)
• Django: HttpRequest sources, ORM sinks, views (feat: Django and HTTP client models #44: TypedParameter on request classes, class-based views through EntryPoint bases, view decorators, raw cursor / RawSQL / raw / extra SQL sinks, mark_safe / HttpResponse HTML sinks, escape sanitizers; URL configurations are not read)
• FastAPI: route handlers and request sources (feat: framework models for Flask, FastAPI and SQLAlchemy #31: FastAPI and APIRouter entry points, response sinks)
• SQLAlchemy: SQL sinks (feat: framework models for Flask, FastAPI and SQLAlchemy #31: execution sinks on engines, connections and sessions; sqlite3 sinks in the stdlib models)
• Requests / httpx: SSRF sinks and response sources (feat: Django and HTTP client models #44: module, Session, Client and AsyncClient request functions as SSRF sinks and http-response sources)
• Detectors stay generic (SQLInjectionDetector, not FlaskSQLInjection) (feat: framework models for Flask, FastAPI and SQLAlchemy #31, no detector changed)

Reference: docs/architecture.md §15 Analysis Providers and Detectors, §25 Plugin Types, §36 Plugin Composition.

Delivery: #31 (Flask, FastAPI, SQLAlchemy, EntryPoint model, symbol derivation)
Delivery: #44 (Django, Requests/httpx, typed parameters, class-based entry points)