Determine correct propagation behavior for ambiguous cases about go-flow-levee HOT 1 CLOSED

I have investigated ssa.UnOp instructions and I believe the best we can do for now is to keep visiting the Operands. Under the current approach I don't see a straightforward way to handle the following cases without visiting the Operands. I think this would be easy to handle with an interpretation-based approach, however.

First, consider this case:

func TestArrOfPointersIsTainted(s core.Source, arr [1]*string) {
	colocateArrOfPointers(s, arr)
	core.Sink(arr) // want "a source has reached a sink"
}

The relevant portion of the SSA graph is:

We need to traverse to the Operand (in this case, t1) when coming from the Call, because otherwise we can't get to the sink.

Also consider this case:

func TestSanitizedSourceDoesNotTriggerFindingWhenTypeAsserted(s *core.Source) {
	sanitized := core.Sanitize(s)[0].(*core.Source)
	core.Sinkf("Sanitized %v", sanitized)
}

The relevant portion of the SSA graph is:

We need to traverse to the Operand in order to find the Sanitizer. Otherwise, the Source produced by the TypeAssert is considered unsanitized. This could be seen as a failure of the isProducedBySanitizer function. I have opened an issue here: #237.

from go-flow-levee.