C#: Update MaD models to taint entire byte- and char collection.

[michaelnebel]

If a collection of bytes and chars are returned by an API, we now consider the entire collection tainted instead of only the elements of the collection. According to DCA this generates more alerts for some of our existing queries and the results appear to be sound.

@hvitved : Should we consider merging this?

[Copilot]

Pull Request Overview

This PR streamlines byte and char array bulk models in C# taint analysis by treating entire collections as tainted instead of only individual elements. The change affects how taint propagates through byte and char arrays/collections, which are commonly used as alternatives to strings in security-sensitive scenarios.

Key changes:

• Updated taint tracking models to treat entire byte/char collections as tainted rather than just individual elements
• Modified flow models for APIs like Stream.Read, Convert.FromBase64String, and related methods
• Updated test expectations to reflect the new bulk taint behavior

Reviewed Changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated no comments.

File	Description
csharp/ql/lib/ext/System.model.yml	Updates Convert class method models to treat entire byte/char arrays as tainted
csharp/ql/lib/ext/System.IO.model.yml	Updates Stream and TextReader method models to use bulk taint for byte/char arrays
csharp/ql/lib/change-notes/2025-08-18-byte-char-bulk-types.md	Documents the change as a minor analysis improvement
Multiple .expected files	Updated test expectations reflecting new taint flow behavior

[hvitved]

LGTM