Python: test closure instance cross-talk

[yoff]

Summary

• add an inline type-tracking regression for two closures created from one wrapper AST with different captured callables
• keep positive controls for the sensitive callable and ordinary captured data
• mark the safe closure result as SPURIOUS so this tests-only draft remains green

Motivation

This is an experimental dependent follow-up to #21925. The improved shared-CFG/SSA routing exposes cross-talk in generic decorator factories such as Django keep_lazy and Airflow provide_session / action_cli: separate wrapper instances can capture different callables, but callable type tracking currently merges their returns.

Current finding

TypeTrackingImpl::capturedJumpStep transfers the merged outer value into the wrapper scope through a shared type-tracking JumpStep, which intentionally discards call context. Removing that jump eliminates the false positive but also drops legitimate captured callable and data flow. A sound implementation therefore appears to require call-site-specific closure/function-object identity in shared type tracking or dataflow; this draft intentionally does not include a workaround or framework-specific suppression.

Testing

codeql test run python/ql/test/library-tests/dataflow/variable-capture python/ql/test/library-tests/dataflow/typetracking

All four targeted tests pass with the inline SPURIOUS expectations.