Improvements to cpp/improper-null-termination, and to a lesser extent cpp/user-controlled-null-termination-tainted.

• added some test cases inspired by real world (LGTM) results
• fixed a false positive involving functions that return a parameter
• fixed a false positive involving taking the address of a variable
• gave the two queries medium precision

The remaining FPs all seem to be related to branching flows, e.g. where a different variable indicates which branch we've been down / whether the string is initialized / null terminated or not. It's possible StackVariableReachability and TaintTracking alone won't be up to the job and the queries will need a more significant rewrite to fix this. Doing so might allow them to be increased to high precision, but they certainly aren't there yet (see https://lgtm.com/query/5264194598604498103/, https://lgtm.com/query/4764927980359278490/).

TODO:

• check performance (that it's OK in general, more so than concerns about regression; since we're giving the query a precision tag it will be used more often)