feat: add security sink detection patterns for JavaScript/TypeScript

- Introduced `sink-detect.js` with various security sink detection patterns categorized by type (e.g., command injection, SQL injection, file operations).
- Implemented functions to build a lookup map for fast sink detection and to match sink calls against known patterns.
- Added `package-lock.json` for dependency management.

src/VexHub/StellaOps.VexHub.WebService/Models/VexApiModels.cs

@@ -0,0 +1,58 @@
+using StellaOps.VexHub.Core.Models;
+
+namespace StellaOps.VexHub.WebService.Models;
+
+/// <summary>
+/// Response containing VEX statements.
+/// </summary>
+public sealed class VexStatementsResponse
+{
+    public required IReadOnlyList<AggregatedVexStatement> Statements { get; init; }
+    public required int TotalCount { get; init; }
+    public required string QueryType { get; init; }
+    public required string QueryValue { get; init; }
+}
+
+/// <summary>
+/// Response for VEX search queries.
+/// </summary>
+public sealed class VexSearchResponse
+{
+    public required IReadOnlyList<AggregatedVexStatement> Statements { get; init; }
+    public required long TotalCount { get; init; }
+    public required int Limit { get; init; }
+    public required int Offset { get; init; }
+}
+
+/// <summary>
+/// VEX Hub statistics.
+/// </summary>
+public sealed class VexHubStats
+{
+    public required long TotalStatements { get; init; }
+    public required long VerifiedStatements { get; init; }
+    public required long FlaggedStatements { get; init; }
+    public required DateTimeOffset GeneratedAt { get; init; }
+}
+
+/// <summary>
+/// VEX Hub index manifest for tool integration.
+/// </summary>
+public sealed class VexIndexManifest
+{
+    public required string Version { get; init; }
+    public required DateTimeOffset LastUpdated { get; init; }
+    public required VexIndexEndpoints Endpoints { get; init; }
+}
+
+/// <summary>
+/// VEX Hub API endpoints.
+/// </summary>
+public sealed class VexIndexEndpoints
+{
+    public required string ByCve { get; init; }
+    public required string ByPackage { get; init; }
+    public required string BySource { get; init; }
+    public required string Search { get; init; }
+    public required string Stats { get; init; }
+}