Improve memset analysis

[sim642]

This contains additional attempts to improve race detection precision on zstd after the soundness fixes.

I noticed that certain memset calls are accessing an unreasonably large number of memory locations and causing write races there. As a special function, the access analysis calculates the set of reachable addresses from its argument(s) and emits writes to all of them. Notably, if a memset struct contains a pointer to something else (another struct), then a write to the latter is also added. But this is unnecessarily imprecise, because memset only changes/writes what it immediately points to and doesn't dereference any pointers inside. In general special functions may do that, but memset (and probably many others) don't as generic functions, so instead of reachable addresses it suffices to just emit accesses to may point to addresses (i.e. not go transitive).

Additionally, I tried to fix #691, i.e. add explicit memset handling to base analysis as well. My hope is that this avoids introducing at least some unknown pointers whose calls later cause spurious races.

Changes

1. Hack access analysis to not use reachability for memset. This is very ad-hoc for the time being. Ideally each invalidation argument would also specify whether it may access transitively or not.
2. Cherry-pick access analysis type-partitioning unsoundness fix from Add option for ignoring races from free #695 because a similar (but not the same) issue appears here (no alloc variables in the failing test). Instead, the access analysis incorrectly calculates the type of the memset argument as void because it's implicitly cast to void* by CIL for memset. Considering how stupidly the type-partitioning fails, I have serious doubts about fixing it.
3. Implement memset handling in base analysis to write a zero value of the corresponding type if memset argument is 0 (closes Zero-initialization using memset #691).
4. Together with the previous, the special handling in other cases (non-zero argument), only writes top values to direct addresses, not all indirect ones via reachability (analogously to access analysis). Therefore it should also improve memset precision on non-zero arguments as well by avoiding all reachable invalidation.

TODO

• Add special __builtin_memset handling as well, because zstd's macro calls it directly.
• Check if this helps on zstd.
• Apply same improvement to free instead of Add option for ignoring races from free #695?

[sim642]

On top of #695 (comment), this doesn't seem to help much either:

 Summary for all memory locations:
-	safe:         2001
-	vulnerable:    181
-	unsafe:        863
-	-------------------
-	total:        3045
+	safe:         1736
+	vulnerable:    68
+	unsafe:        870
+	-------------------
+	total:        2674

Also, this seemed to increase the analysis time from ~40min to ~48min.

Still, the memset related write accesses are gone though, but the unknown function pointer call ones remain and are a frequent cause for races.