Resolve undecided paths, URLs, redirects and tests

[tauanbinato]

Stacked on #29. JevGate reports an answer that stays undecided as uncertain rather than hiding it. On the corpus, 1.39% of judged units ended that way (2,876 units). Most came from two places:

• 813 injection units whose path, URL or redirect check stayed between the thresholds
• 792 tests whose hollow checks ("checks only its mocks", "recomputes its expected value") did the same after their recheck

This takes undecided units to 0.83% (1,716). No review or consider changes on any of the 117 projects.

What changes

• Paths, outside PHP: an undecided path check is asked, with its callers, where the paths come from:

  • the program's own directories or configuration
  • the command line or settings of the person running a local program
  • a whole path its caller gives
  • another party's input (a request, an uploaded file or archive entry, a record users can edit)

  The program's own or the local user's paths clear it. That's 74 units on the corpus, for about $0.02.

• Parameters in a path, URL or redirect: a found check from the function's parameters was already a note. An undecided one stayed uncertain. Now, once the Choice that settles the check was asked and doesn't lean toward another party's input, it's the same note, naming the path, URL or redirect. 450 units had stayed uncertain that way.

• Tests: a test whose hollow checks stay undecided once its recheck is asked leans: below 0.50 it's clear. Nothing is asked again.

Evidence

• Tests: 80 undecided tests were sampled across the corpus, weighted toward the upper half, and judged from the code without their probabilities. Below 0.50, 4 of 43 were hollow (5 counting a test whose one real check is weak). At 0.50 or more, 10 of 35 were. So only the lower half leans clear. The rest stay undecided, 156 in all.
• Paths: the docs record that an earlier path Choice cleared real traversals by reading names stored in an index as the program's own. This one names records users can edit as another party's input. Its clears include httprouter serving public/ through http.Dir and a storage path built from a user id and an encoded file id. None hit a documented traversal in the vulnerable apps.

Undecided units	main	#29	this PR
injection	813	813	289
tests/value	792	792	156
all rules	2,876 (1.39%)	2,876	1,716 (0.83%)

Review notes

• Policy call: turning undecided units into clears or notes trades an honest "don't know" for a lean. The labels support the test lean below 0.50. The path/URL/redirect notes follow the rule's own policy that parameters there are a note until a caller shows another party controls them. Say if you'd rather keep either as uncertain.
• Self-check: no unbaselined review or consider. It flagged the new Choice's callers note as a copy of the URL Choice's, now shared.
• CI's review: it runs the released 0.20.0, which adds two considers. One is on src/units/questions/settle.rs ("the same kind of code for several features"), which Audit 0.20.0 on 103 projects: crash and hang fixes, security checks, precision caps #26's per-feature file kind already treats as one job. The other is on asked_checks, unchanged here.