C++: Replace QL models for std::map (and friends) with MaD models - #22939

This PR adds MaD summaries for std::map, std::unordered_map, std::string, std::pair, and std::string_view.

Commit-by-commit review strongly recommended!

This work brings together a bunch of PRs that has been merged over the last couple of weeks/months(/years):

• C++: Don't use Fields to define FieldContent #20901 which fixed a performance problem that was blocking this work
• C++: Implement MaD support for flow through perfect-forwarding functions #22532 and C++: Improve logic for perfect forwarding #22654 which allows us to model various insert-like functions properly
• Shared: Support flow summaries from ReturnValues #22061 which allows us to model writes into std::strings properly
• C++: Support access paths for sources and sinks #22374 which is needed to correctly model some of the azure sources after these changes.

There are a lot of moving parts here. Here are the highlights:

• It turns out there were a lot of type issues in our std container tests. These were not a problem with the old models, but they cause missing forward-related flow (since we use the argument/parameter types to identify the right constructor to forward to).
• The forwarding MaD syntax didn't handle nested typedefs, which meant it was impossible to refer to specify that std::map::emplace constructed a value of type std::map<Key, Value>::value_type.
• In order to forward arguments to a specific constructor that constructor has to exist in the database. So the tests had to be rewritten slightly to ensure that the right templates were instantiated so that the constructors existed. This won't be a problem in a real database since those constructors are invoked by the std container implementations, so they obviously exist in the database.
• After adding all the forwarding models the forwarding logic turned out to have some performance problems.
• Correctly tracking the values in cpp/cleartext-storage-file revealed two problems in that query (and the other CWE-311 query):
  • The barriers were too strong. They blocked flow to chars which meant that a copying loop iterating over each char in a std::string would be blocked.
  • The queries always used asExpr which meant that we tracked the reference when the sensitive variable was a reference, and otherwise we tracked the value.
• Being more precise about taint into containers also revealed a problem with how we picked which node for which asExpr and asIndirectExpr should have a result when the expression is a glvalue. I've added a rather long explanation for why the new behavior is what we want.
• Adding more STL stubs made the extractor (with --check-databases) unhappy about duplicated declarations breaking ODR. So I also refactored those tests at the very end.

DCA is rather uneventful. A couple of new results:

• The SAMATE ones are new TPs
• The new cpp/return-c-str-of-std-string result is a false positive which comes from the existing query logic.
• The 5 lost cpp/non-constant-format result are FPs which are now removed. The sources in those query results are all allocations of internal STL buffers which we now exclude from dataflow since we have precise MaD models of the enclosing functions.
• The lost results in the Diffed query result tuple counts table are all from results now being deduplicated better:
  • The cpp/command-line-injection ones are similar to what we've seen in our query tests
  • The cpp/tainted-format-string ones are because we now track indirection flow properly through std::map. For example we'd previously get a result for both data and *data here because we conflated the pointer and the pointee when we insert into (and pull out) the std::map, and now we only get a result for *data as expected.