Add qldoc comments to address PR review

Author: data-douser

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll

@@ -27,6 +27,13 @@ private class RemoteControlHandlerParameter extends RemoteControlAPISource, Call
   }
 }
 
+/**
+ * A remote flow source representing user-provided data fetched from UI5 input controls.
+ *
+ * This class models data obtained from control references (such as `HTML` or `CodeEditor`)
+ * or from handler parameters, via property reads or getter methods like `getValue()` or
+ * `getCurrentValue()`. These represent user input that could potentially be tainted.
+ */
 private class UserDataFromRemoteControlAPISource extends RemoteFlowSource {
   UserDataFromRemoteControlAPISource() {
     exists(RemoteControlAPISource remoteControlAPISource |

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/FlowSteps.qll

@@ -398,6 +398,13 @@ class LogArgumentToListener extends DataFlow::SharedFlowStep {
   }
 }
 
+/**
+ * A data flow step from published event data to subscribed event handlers via the UI5 EventBus.
+ *
+ * This step connects data passed to `EventBus.publish()` calls to the corresponding
+ * data received by matching `EventBus.subscribe()` handlers, enabling taint tracking
+ * across event-driven communication patterns in UI5 applications.
+ */
 class PublishedEventToEventSubscribedEventData extends DataFlow::SharedFlowStep {
   override predicate step(DataFlow::Node start, DataFlow::Node end) {
     exists(