Azure python sdk url summary upstream

[bdrodes]

• Added MaD sinks for URLs in the azure SDK, labeled as 'ssrf'
• Updated HTTP request clients to use 'ssrf' MaD

[Copilot]

Pull Request Overview

This PR adds Server-Side Request Forgery (SSRF) modeling for the Azure Python SDK by introducing MaD (Models as Data) sinks and updating HTTP request clients to recognize SSRF vulnerabilities. This enables CodeQL to detect when user input can control URLs passed to Azure SDK methods.

• Added SSRF sink modeling framework for MaD-based HTTP requests
• Created comprehensive Azure SDK models for KeyVault and Storage services
• Added test coverage for Azure client SSRF scenarios

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
python/ql/lib/semmle/python/frameworks/SSRFSink.qll	New framework for handling SSRF sinks through MaD models
python/ql/lib/semmle/python/frameworks/Azure.Storage.model.yml	MaD definitions for Azure Storage SDK SSRF sinks
python/ql/lib/semmle/python/frameworks/Azure.Keyvault.model.yml	MaD definitions for Azure KeyVault SDK SSRF sinks
python/ql/lib/semmle/python/Frameworks.qll	Import statement for new SSRFSink framework
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py	Test cases for Azure SDK SSRF detection
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/PartialServerSideRequestForgery.expected	Expected results for partial SSRF tests
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/FullServerSideRequestForgery.expected	Expected results for full SSRF tests
python/ql/lib/change-notes/released/2025-09-30-azure_ssrf_models	Release notes for the changes