Python: unpin legacy CFG/ESSA from the AST cached stage (DCA measurement)

[yoff]

Note

Draft for measurement. This PR exists to run DCA and quantify how much of the shared-CFG dataflow flip's overhead is recovered by not computing the legacy CFG. It is based on the flip branch (yoff/python-shared-cfg-dataflow-flip, #21925), so the diff is exactly the one-commit change and the DCA a/b isolates the effect of the unpin.

What

The legacy CFG (Flow.qll) and legacy ESSA (Essa/SsaCompute/SsaDefinitions) are pinned into the always-on Stages::AST cached stage via Stages::AST::ref() (11 sites) and the matching Stages::AST::backref() disjuncts.

backref() is referenced nowhere and optimizes to 1 = 1, so the ref/backref pattern only controls stage assignment. Because a cached stage is materialised as a unit once any of its predicates is demanded — and every query demands e.g. Expr.toString() — this forces the legacy CFG/ESSA to be computed for every query.

After the shared-CFG dataflow flip, the security/dataflow queries no longer depend on the legacy CFG at all, so on the flip branch this computation is pure dead weight.

This PR removes those pins. Since Stages::AST::ref() is 1 = 1, the change is result-preserving — it only changes stage scheduling.

Verification (result-preserving)

• Full python-security-extended suite (52 queries) and django: legacy CFG/ESSA predicate families materialised drop from ~165 → 0, with byte-identical results.
• Cold, fresh-DB django: 59.9s → 57.6s wall (-j4); ~9.5s of legacy predicate self-time removed (≈1.3% of total analysis CPU).

Question DCA should answer

The legacy CFG the security queries drag in (~9.5s CPU, 1.3%) is a fraction of the new CFG+SSA the flip adds (~37.6s CPU, 5.3%), so a-priori this recovers only ~a quarter of the new-CFG cost, not the full flip overhead. DCA across the target set will give the authoritative per-project number.

Caveats before this could merge

• This is a global stage change. Security queries win; the points-to/quality queries (which genuinely use legacy ESSA) will still compute it, but now in their own stage(s) rather than sharing the AST stage — need to confirm no regression there.
• A cleaner design would pin legacy CFG/ESSA to an explicit dedicated stage instead of leaving placement to the optimizer.