C++: Use the IR for cpp/return-stack-allocated-memory.

[MathiasVP]

This query is a perfect query for the IR. Without really thinking too hard about it I was able to remove all the false positives from our tests for this query 🎉.

I changed the behavior of the query to not report 'may' flow, but only 'must' flow. This removes the possibility of FPs from complex path conditions which we cannot reason about.

This has no influence on Samate since Samate has a very low number of tests for this CWE. It does find a bunch of good results on LGTM, though (I've provided a link in the internal issue).

[geoffw0]

I'm a bit sad that so much query code is needed that feels like it should be done by a library. But the results on tests are very impressive, the upgrade to a path-problem is progress, and real world results I've looked at LGTM. 👍

[MathiasVP]

I'm a bit sad that so much query code is needed that feels like it should be done by a library.

Yeah, most of the code is really because I re-invented the 'must flow' library like I did in #4644. I think we can pull some shared parts out into a "intraprocedural must flow" library in the future, which should hopefully cut most of this code away.

[geoffw0]

I think we can pull some shared parts out into a "intraprocedural must flow" library in the future, which should hopefully cut most of this code away.

Sounds good, and I agree this should be done outside of this PR.