Content providers manage access to a central repository of data. They can be accessed by Android applications through an interface that allows different actions (query, insert, update, delete, open a file...). If a content provider is exported, any application in the device can send arbitrary data to that interface, which opens a new attack surface against the application the provider is part of.

This PR adds source models for the entry-point methods of content providers that can be externally accessed when the content provider is exported. Note that some code was added for working with permissions in content providers, but it's ultimately not used to discard potential sources because a malicious application could request those permissions to exploit a vulnerability anyway.

This increases our CVE coverage by detecting CVE-2019-5454.