Find thread suspensions with a user-controlled duration

Finds Thread.sleep(..), TimeUnit.sleep(..) and LockSupport.parkNanos(..) calls whose duration comes from HTTP request input (CWE-400). A caller who chooses how long a request thread is suspended can hold every thread in the pool with a handful of requests. Sources are servlet request accessors, Spring WebRequest accessors, and Spring MVC handler parameters bound with @RequestParam, @PathVariable, @RequestHeader, @RequestBody, @RequestPart, @CookieValue, or @MatrixVariable. A duration with a constant upper bound is not marked: Math.min or StrictMath.min with a constant operand, clamp with a constant maximum, a ternary that picks a constant when the value is larger, or a local variable or parameter that is never reassigned and is checked against a constant upper bound before the call. Math.max and a lower bound are not a cap, and a cap passed through another call, as in Duration.ofMillis(Math.min(ms, 1000)), is not recognized. Timed waits such as Object.wait(long), Thread.join(long) and Future.get(long, TimeUnit) are not searched. Test sources are searched too.