[DRAFT] [inferbo] bounds-check array fields of local structs and objects

[VladimirMakaev]

Inferbo declared no arrays for the array fields of local structs and C++ objects, so their
accesses went unchecked. Array fields passed to functions or models, as in g(s.arr) or
strcpy(p->name, src), evaluated to the field's cell instead of its array, also for heap and
parameter structs.

#include <string.h>

struct S {
  int arr[4];
  char name[8];
};

void f(void) {
  struct S s;
  s.arr[4] = 0; // Infer missed: buffer overrun
  strcpy(s.name, "12345678"); // Infer missed: buffer overrun
}

Locals now get arrays for their nested array fields, except trailing arrays of length 0 or 1,
which may be flexible. Array fields decay to their arrays in calls and models. String literals
and struct copies are copied into the destination's arrays instead of replacing them, which
removes false positives on initializers such as struct S s = {{0}, "abc"}; or a C++
char name[16] = "";. Part of #1444, with #2192. #2208's eval_array replaces eval_arg only
in the StdArray models.

Test plan

New tests in c/bufferoverrun and cpp/bufferoverrun; FN_call_access_index_4_on_S2_Bad is
now reported and renamed. The codetoanalyze tests pass. With --bufferoverrun-only: lua
(without lgc.c) -2 INTEGER_OVERFLOW_L2, civetweb -1 BUFFER_OVERRUN_L3, libuv +1 runtime-safe
BUFFER_OVERRUN_L2 (as for local arrays); zlib, cJSON, libyaml and hiredis unchanged.