Add CodeQL query: WebClient.create without idle timeout (java/vertx/webclient-missing-idle-timeout)

[Copilot]

Implements a new CodeQL rule detecting WebClient.create calls that omit a WebClientOptions with an explicit setIdleTimeout, which can leave connections hanging indefinitely and exhaust resources.

Query (WebClientMissingIdleTimeout.ql)

Flags two cases:

• WebClient.create(vertx) — no WebClientOptions passed at all
• WebClient.create(vertx, options) — options passed but setIdleTimeout never called on the variable

// Flagged — no options, no idle timeout
WebClient client = WebClient.create(vertx);

// Safe — explicit idle timeout set
WebClientOptions options = new WebClientOptions()
        .setIdleTimeout(30)
        .setIdleTimeoutUnit(TimeUnit.SECONDS);
WebClient client = WebClient.create(vertx, options);

Metadata: @id java/vertx/webclient-missing-idle-timeout, severity warning, security-severity 5.0.

Supporting files

• .qhelp — help file with overview, recommendation, and annotated examples
• Example Java sources — insecure/secure samples referenced from the help file (src/main/ql/java/.../webclient/)
• Test stubs — minimal WebClient and WebClientOptions stubs under src/test/ql/test/stubs/io/vertx/ext/web/client/
• Test case — InsecureWebClient.java (expected alert) and SecureWebClient.java (no alert) with .qlref, .expected, and options files

• Fixes Implement a CodeQL rule for cases where WebClient.create is used without setting a WebClientOptions with an explicit setIdleTimeout #6