New audit: obfuscation

[woodruffw]

Obfuscation isn't a security issue per se, but often suggests that the author is trying to hide their intent. Obfuscated workflows are also harder for us to analyze, so producing findings for some common cases will help us nudge users towards things we can analyze.

Some patterns we want to detect:

• Unnecessary use of format(...): format(fstring, ...args) is unnecessary when all args are literals
• Unnecessary wrappings of fromJSON(toJSON(...)) or vice versa
• Double negation
• contains(haystack, needle) where both are literals
  • Same for startsWith and endsWith