Detection coverage: syntactic rules and models for aiohttp, Tornado, Bottle and database drivers #70

Extend detection with cheap syntactic rules and models for frameworks and drivers not covered yet.

• Syntactic rules: verify=False on HTTP clients, XML parsing without protection, tarfile/zipfile extraction of received archives, tempfile.mktemp, random used for secrets or tokens.
• Framework models: aiohttp (entry points, request sources, response sinks); Tornado and Bottle below.
• Framework models: Tornado and Bottle.
• dvpwa (aiohttp, in the regression corpus) documents SQL injections and XSS that stay silent without those models; its snapshot should show them once aiohttp is modelled.
• Database driver models: aiopg, psycopg2, pymysql, asyncpg (statement sinks with positions).
• Each rule and model documented in the usage and plugin guides; acceptance tests first.