C#: inline TestAdditionalTaintStep.qll into AdditionalTaintStep.ql

Addresses review comment: the test-only AdditionalTaintStep subclass
only has a single consumer, so fold it directly into the query file
instead of keeping it in a separate .qll.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: hugo-syn

csharp/ql/test/library-tests/dataflow/additional-taint-step/AdditionalTaintStep.ql

@@ -1,6 +1,23 @@
 import csharp
+import semmle.code.csharp.dataflow.FlowSteps
 import semmle.code.csharp.dataflow.internal.TaintTrackingPrivate
-import TestAdditionalTaintStep
+
+/**
+ * A test-only additional taint step that treats calls to `Marker.Step` as
+ * propagating taint from the argument to the call result, to verify that
+ * `AdditionalTaintStep` subclasses are picked up by `defaultAdditionalTaintStep`.
+ */
+private class MarkerStepTaintStep extends AdditionalTaintStep {
+  override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
+    exists(MethodCall mc |
+      mc.getTarget().hasName("Step") and
+      mc.getTarget().getDeclaringType().hasName("Marker")
+    |
+      node1.asExpr() = mc.getArgument(0) and
+      node2.asExpr() = mc
+    )
+  }
+}
 
 from DataFlow::Node src, DataFlow::Node sink, string model
 where defaultAdditionalTaintStep(src, sink, model) and model = "AdditionalTaintStep"