Python: Don't rely on all DataFlowCall being resolved

I've been living dangerously with that assumption :|

Author: RasmusWL

python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll

@@ -87,6 +87,7 @@ newtype TInterestingExternalApiCall =
   } or
   TResolvedCall(DataFlowPrivate::DataFlowCall call) {
     exists(call.getLocation().getFile().getRelativePath()) and
+    exists(call.getCallable()) and
     not call.getCallable() = any(SafeExternalApi safe).getSafeCallable() and
     // ignore calls inside codebase, and ignore calls that are marked as  safe. This is
     // only needed as long as we extract dependencies. When we stop doing that, all

python/ql/test/experimental/dataflow/calls/DataFlowCallTest.ql

@@ -17,7 +17,8 @@ class DataFlowCallTest extends InlineExpectationsTest {
     exists(location.getFile().getRelativePath()) and
     exists(DataFlowDispatch::DataFlowCall call |
       location = call.getLocation() and
-      element = call.toString()
+      element = call.toString() and
+      exists(call.getCallable())
     |
       value = prettyExpr(call.getNode().getNode()) and
       tag = "call"