Determine correct propagation behavior for ambiguous cases

[mlevesquedion]

PR #178 added explicit handling for each node type.

For most node types, it is obvious what the correct behavior is, e.g. when doing a MapUpdate, we shouldn't be traversing to the Key or the Value, only the Map.

For other node types, the correct behavior is not obvious.

Here are the cases that need further investigation, and likely, more tests:

• Field: addressed by Refactor: Unify traversal through Field and FieldAddr instructions #201.
• Store: addressed by Fix: Only traverse to store addr #199.
• Select and SelectCase: addressed by Improvement: Handle select instructions #235.
• MakeInterface: see Tainting an interface value should not taint the contained value #209.
• TypeAssert: see Leverage type information provided by type assertions #210.
• Lookup and Next.
• Slice: see Handle slice instructions #236.
• UnOp: see below.

[mlevesquedion]

I have investigated ssa.UnOp instructions and I believe the best we can do for now is to keep visiting the Operands. Under the current approach I don't see a straightforward way to handle the following cases without visiting the Operands. I think this would be easy to handle with an interpretation-based approach, however.

First, consider this case:

func TestArrOfPointersIsTainted(s core.Source, arr [1]*string) {
	colocateArrOfPointers(s, arr)
	core.Sink(arr) // want "a source has reached a sink"
}

The relevant portion of the SSA graph is:

We need to traverse to the Operand (in this case, t1) when coming from the Call, because otherwise we can't get to the sink.

Also consider this case:

func TestSanitizedSourceDoesNotTriggerFindingWhenTypeAsserted(s *core.Source) {
	sanitized := core.Sanitize(s)[0].(*core.Source)
	core.Sinkf("Sanitized %v", sanitized)
}

The relevant portion of the SSA graph is:

We need to traverse to the Operand in order to find the Sanitizer. Otherwise, the Source produced by the TypeAssert is considered unsanitized. This could be seen as a failure of the isProducedBySanitizer function. I have opened an issue here: #237.