Address CCR: require implicit-this receiver for bracket calls

Copilot Code Review correctly flagged that isBracketedForTagHelperAttribute
never related the receivers of beginCall/writeLiteral/endCall, so a bracket
on one page instance could theoretically be mistaken for a bracket around a
WriteLiteral call on a different page (e.g. otherPage.BeginWriteTagHelperAttribute();
this.WriteLiteral(model); otherPage.EndWriteTagHelperAttribute();).

Require all three calls to have an implicit 	his qualifier, which is how
the Razor source generator always emits them, guaranteeing they act on the
same page instance. Re-verified: XSS.ql compiles, all 6 CWE-079 tests pass,
and the real customer reproduction database still shows the FP suppressed
and the genuine Html.Raw positive control still reported.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: felickz

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Html.qll

@@ -196,14 +196,23 @@ class MicrosoftAspNetCoreMvcHtmlHelperRawSink extends AspNetCoreHtmlSink {
  * are the immediately enclosing bracket around `writeLiteral` on every path that reaches it (that
  * is, the bracket opened by `beginCall` is still open, and not yet closed by some other `endCall`,
  * at the point `writeLiteral` executes).
+ *
+ * `beginCall`, `writeLiteral`, and `endCall` are additionally required to have an implicit `this`
+ * qualifier, which is how the Razor source generator always emits these calls. This ensures all
+ * three calls act on the same page instance, so a bracket on one page cannot be mistaken for a
+ * bracket around a `WriteLiteral` call on a different page.
  */
 private predicate isBracketedForTagHelperAttribute(Call writeLiteral) {
   exists(
-    MicrosoftAspNetCoreMvcRazorPageBase page, Call beginCall, Call endCall, int i, int j, int k
+    MicrosoftAspNetCoreMvcRazorPageBase page, MethodCall beginCall, MethodCall endCall, int i,
+    int j, int k
   |
     writeLiteral = page.getWriteLiteralMethod().getACall() and
     beginCall = page.getBeginWriteTagHelperAttributeMethod().getACall() and
     endCall = page.getEndWriteTagHelperAttributeMethod().getACall() and
+    writeLiteral.(QualifiableExpr).hasImplicitThisQualifier() and
+    beginCall.hasImplicitThisQualifier() and
+    endCall.hasImplicitThisQualifier() and
     writeLiteral.getBasicBlock().getNode(i) = beginCall.getControlFlowNode() and
     writeLiteral.getBasicBlock().getNode(j) = writeLiteral.getControlFlowNode() and
     writeLiteral.getBasicBlock().getNode(k) = endCall.getControlFlowNode() and