CWE-770: correct GlobalAlloc sink MISSING comment

The prior comment claimed the blanket impl methods have no canonical
path. They now do (`<_ as ..::GlobalAlloc>::alloc`); the accurate reason
is the type-parameter `Self`, so the path-keyed sink model misses them.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01

Author: redsun82

rust/ql/test/query-tests/security/CWE-770/main.rs

@@ -190,8 +190,8 @@ unsafe fn test_system_alloc(v: usize) {
     let _ = std::alloc::Global.allocate_zeroed(l1).unwrap();
 
     let l2 = std::alloc::Layout::array::<u8>(v).unwrap();
-    // `GlobalAlloc` is a legacy trait, blanket-implemented for `GlobalAllocator` types, so these
-    // resolve to the blanket impl whose methods have no canonical path; the sink models miss them.
+    // These resolve to the blanket `impl GlobalAlloc for A` in `core`, so the target's canonical
+    // path has a type-parameter `Self` (`<_ as ..::GlobalAlloc>::alloc`); the sink model misses it.
     let _ = std::alloc::System.alloc(l2); // $ MISSING: Alert[rust/uncontrolled-allocation-size]=arg1
     let _ = std::alloc::System.alloc_zeroed(l2); // $ MISSING: Alert[rust/uncontrolled-allocation-size]=arg1
     let _ = std::alloc::System.allocate(l2).unwrap(); // $ Alert[rust/uncontrolled-allocation-size]=arg1
@@ -201,7 +201,7 @@ unsafe fn test_system_alloc(v: usize) {
 
     let l3 = std::alloc::Layout::array::<u8>(10).unwrap();
     let m3 = std::alloc::System.alloc(l3);
-    // `System.realloc` resolves to that same `GlobalAlloc` blanket impl (see above); MISSING.
+    // `System.realloc` resolves to that same blanket `GlobalAlloc` impl (see above); MISSING.
     let _ = std::alloc::System.realloc(m3, l3, v); // $ MISSING: Alert[rust/uncontrolled-allocation-size]=arg1
 
     let l4 = std::alloc::Layout::array::<u8>(10).unwrap();