This PR adjusts some of the security-severity scores to better reflect the quality of the queries producing the alerts.

• Queries with speculative threat model
  Some queries use a speculative threat model, e.g. by using library inputs or environment variables as taint sources. This was generally reflected in the old precision/severity metadata, but not in the security-severity. For these queries, I've updated the scores using the CVSS calculator by setting 'Attack Complexity' to High and 'User Interaction' to Low (as opposed to None).

• Tainted format string
  The CWE number for the TaintedFormatString query is associated with buffer overflows from printf/scanf-style functions in C++, which is probably why it had a high derived security-severity score (9.3). But in JavaScript, a tainted format string is unlikely to lead to anything worse than log injection so I've manually update its score to reflect this (7.3).

• Loop bound injection
  The LoopBoundInjection query is a denial-of-service query, but was missing the CWE-730 tag
  ("denial of service") and had a lower score than the other DoS queries. I've added the CWE tag and
  updated its security-severity to match the other denial-of-service queries.

• Code injection query
  The derived security-severity score of the JS CodeInjection query was much lower than for other languages (6.1 versus 9.3), possibly due some differences in CWE tags, such as the inclusion of CWE-079. I've also added the more specific CWE-095 ("eval injection") for consistency with other languages. It is a child of already-used CWE-094 ("code injection").