Kotlin: cover collection literal extraction

Add focused coverage for a collection literal resolved through a companion
operator fun of. Check the call target, arguments, result type, locations,
and element data flow through the resulting collection.

The existing extractor handles the lowered call correctly. This commit adds
coverage only and requires no extractor change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: andersfugmann

java/ql/test-kotlin2/library-tests/collection-literal-operators/test.expected

@@ -0,0 +1,7 @@
+literalCall
+| test.kt:14:24:14:40 | of(...) | test.kt:5:18:5:62 | of | Words | test.kt:14:24:14:40 | Companion | 2 |
+literalArguments
+| test.kt:14:24:14:40 | of(...) | 0 | test.kt:14:25:14:32 | source(...) |
+| test.kt:14:24:14:40 | of(...) | 1 | test.kt:14:35:14:39 | "two" |
+#select
+| test.kt:14:25:14:32 | source(...) | test.kt:15:10:15:24 | ...[...] |

java/ql/test-kotlin2/library-tests/collection-literal-operators/test.kt

@@ -0,0 +1,16 @@
+// codeql-extractor-kotlin-options: -language-version 2.4 -XXLanguage:+CollectionLiterals
+
+class Words private constructor(val values: Array<out String>) {
+    companion object {
+        operator fun of(vararg values: String) = Words(values)
+    }
+}
+
+fun source(): String = ""
+
+fun sink(value: String) {}
+
+fun test() {
+    val words: Words = [source(), "two"]
+    sink(words.values[0])
+}

java/ql/test-kotlin2/library-tests/collection-literal-operators/test.ql

@@ -0,0 +1,30 @@
+import java
+import semmle.code.java.dataflow.TaintTracking
+
+query predicate literalCall(
+  MethodCall call, Method target, string resultType, Expr qualifier, int argumentCount
+) {
+  target = call.getMethod() and
+  target.hasName("of") and
+  call.getEnclosingCallable().fromSource() and
+  resultType = call.getType().toString() and
+  qualifier = call.getQualifier() and
+  argumentCount = call.getNumArgument()
+}
+
+query predicate literalArguments(MethodCall call, int index, Expr argument) {
+  call.getMethod().hasName("of") and
+  argument = call.getArgument(index)
+}
+
+module Config implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node n) { n.asExpr().(MethodCall).getMethod().hasName("source") }
+
+  predicate isSink(DataFlow::Node n) { n.asExpr().(Argument).getCall().getCallee().hasName("sink") }
+}
+
+module Flow = TaintTracking::Global<Config>;
+
+from DataFlow::Node source, DataFlow::Node sink
+where Flow::flow(source, sink)
+select source, sink

java/ql/test-kotlin2/library-tests/collection-literal-operators/test.qlref

@@ -0,0 +1 @@
+test.ql