[SizzleUnrlsd]

Summary

First two items of #70: aiohttp and database-driver models. dvpwa, the intentionally vulnerable aiohttp application of the regression corpus, was silent; its documented SQL injection is now found.

• Acceptance tests first (test: define the aiohttp and database-driver models), implementation follows.
• aiohttp-models: an annotated web.Request parameter, a handler registered on the router (app.router.add_route, add_get, web.get(...) in add_routes) or a function decorated by a RouteTableDef receives HTTP input; web.Response is an HTML sink, FileResponse a path sink, the redirect exceptions redirect sinks; ClientSession requests are SSRF sinks whose responses are untrusted http-response input.
• db-driver-models: the statement argument of aiopg, asyncpg, psycopg2 and PyMySQL query methods is a SQL sink, reached through connections, pools, cursors and annotated classes; the parameter tuple is not a statement.
• Two engine refinements the models needed: route registrations are also found inside functions such as def setup_routes(app: Application), where a call on an annotated parameter denotes the class's method; and await f() denotes what f() denotes, so conn = await asyncpg.connect() gives conn.fetch its sink.
• Snapshot: dvpwa gains its SQL injection, Student.create formatting the name into the statement, reached from the students handler; its stored XSS lives in a template |safe filter and its session fixation in session handling, both outside static taint. Nothing else moves; 28 bundled plugins, documented in the usage guide.

Part of #70.