Shared: Support flow summaries from ReturnValues

[MathiasVP]

The std::string class in C++ is mutable so you can do:

std::string s("hello");
s[0] = 'H';

This is just a regular assignment where the left-hand side is a reference to the internal buffer. Historically, to support this in C++ taint-tracking we've specified "reverse flows":

codeql/cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll

Lines 384 to 386 in b8c78fd

	// reverse flow from returned reference to the qualifier
	input.isReturnValueDeref() and
	output.isQualifierObject()

So when an assignment flows from the right-hand side to the left-hand side (i.e., to the returned reference (actually to the indirections of the reference, but nevermind)) the "reverse flow" model transfers flow to the qualifier.

We'd obviously like to get rid of all these old models and replace them with flow summaries. However, flow summaries do not allow for these reverse flow summaries. This PR fixes that so that we can model this using a summary such as ReturnValue[*] -> Argument[this].

Most of the work is in bb2ec12. We add a new summary node (which is expected to be lifted to a proper ArgumentNode by each language) along with a new parameter/argument position to transfer the value into the summarized callable. 662f522 shows how the new predicates are instantiated for C/C++.

Commit-by-commit review recommended.

This PR doesn't actually add any real models to C/C++. However, I have a local branch where I've checked on DCA that the performance of these changes are fine.