JS: Recognize @fastify/rate-limit as a rate limiter

[cysp]

Summary

The js/missing-rate-limiting query reports Fastify routes protected by @fastify/rate-limit as unprotected.

The Fastify rate-limiter model recognizes only the legacy fastify-rate-limit package name. This change adds the current scoped package name while retaining support for the legacy package.

Test coverage

The regression test uses independent Fastify applications to verify that:

• fastify-rate-limit registration remains recognized.
• @fastify/rate-limit registration protects routes declared after registration.
• A route declared before scoped-package registration is still reported as unprotected.
• Existing per-route rate-limiting assertions remain independently exercised.

The red/green behavior was verified directly: before the model change, the focused test failed because the query reported the route following @fastify/rate-limit registration. After the change, the test passes and only the intentionally unprotected route is reported.

Validation

• Focused MissingRateLimit query test: passed
• QL formatting check: passed
• JavaScript query-pack release validation: passed
• git diff --check: passed

Developed and validated with assistance from OpenAI Codex.

[Copilot]

Pull request overview

Adds support for the current scoped Fastify rate-limiter package while preserving legacy compatibility.

Changes:

• Recognizes both Fastify rate-limit package names.
• Adds regression coverage for registration ordering and per-route configuration.
• Documents the analysis improvement.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
MissingRateLimiting.qll	Adds scoped package recognition.
tst.js	Adds independent scoped-package tests.
MissingRateLimiting.expected	Updates expected alerts.
2026-07-22-fastify-rate-limit.md	Adds the change note.