Rust: Query for access to a dangling pointer

[geoffw0]

Query for access to a dangling pointer, i.e. something along the lines of:

let ptr = &raw const my_thing;

// ... my_thing goes out of scope, leaving ptr dangling ...

unsafe {
	_ = *ptr; // BAD
}

This is a draft because I still need to:

• do a DCA run, iterate on results if necessary. here
• I think I want to split the concept of this query in three, as the implementations and documentation might be quite different:
  • dangling pointer access due to lifetime end (implemented in this PR)
  • dangling pointer access due to deallocation (which will have a different implementation, though sources / sinks may be in common)
  • dangling pointer access due to overwritten target (check if this one is really undefined behaviour / real world cases are likely to be on purpose)
• add qhelp with examples.

Then I will need:

• code review.
• docs review.

As you can see from the test, there are a lot of cases we don't cover yet, which will be follow-up work. Right now I want to get a minimal version of the query merged before worrying about them too much.

[geoffw0]

An entirely different approach is possible, where having done the data flow we would check the control flow as well, all the way from the pointer creation to dereference, to see if it crosses a point where the objects lifetime ends. I ran into problems even defining these points, wasn't sure how best to implement that kind of flow effectively, and my attempts didn't get good results so I changed tactics. Nevertheless it could be more accurate in the sense of finding more results, and some of these issues might get easier as our libraries mature.

[geoffw0]

Closing. I'm going to reassemble the pieces into two or three separate queries, and in the process hopefully remember where I was with this work.