Mark realloc as an allocator

It is kind of a strange function, but considering only its return
value, it is an allocator.
Add a bit of commentary on the single initializer analysis

It still needs a bit more, but now some parts are a bit clearer
Update some documentation in the output parameter analysis

This reflects the changes to recognize aggregates used as output
parameters.
Adapt to the refactored escape analysis in llvm-analysis
Extend the outparam analysis to recognize allocations through out params.

This adds a new annotation PAOutAlloc for out parameters that are
freshly allocated by an allocator, and for which the caller assumes
ownership.

This required some extensions to the escape analysis to let the
analysis require that out parameter allocations do not escape via any
assignments besides the one creating the out parameter.
Remove an addressed readme.

This one was actually fixed in the new implementation of
instructionEscapesWith
Use mempty instead of specific Module.empty values

This makes changing data structures easier later.
Missed a mempty
Extend the output parameter allocator analysis

Allow output allocators to also return NULL pointers, mirroring the
allocator analysis.  Note, returning ONLY a NULL pointer does not
count (that is just a normal out parameter).

Also includes interprocedural propagation of PAOutAlloc
Add a note about future work on the nullable analysis
Re-use code from llvm-base-types to extract struct type names
Major enhancements for the initializer analysis

It is now a cheap, unsound, incomplete field-sensitive points to
analysis for function pointers.  It will evolve into a more general
indirect call resolver.  This isn't a general points-to analysis but
is very useful for this project.

This change also improves the precision of the analysis in two ways.

 1) absPathLookup (lookup initializer for abstract path) now
    looks up the result for a path and adds it to the recursively
    reduced path.

    For paths like S.t.foo, this means two lookups:

    * S.t.foo and
    * T.foo

    This is important for cases where S.t.foo is never directly
    initialized; instead, it might be the case that t.foo is
    initialized somewhere and then S.t is assigned that result.

 2) Abstract access paths are now canonicalized before being used.
    Abstract access paths refer to LLVM types to denote their base,
    but often functionally equivalent types cannot be compared for
    equality because the frontends emit strange variants.  Example:

    > %vtbl = { i32(i32*)*, i32(i32*)*, i32(i32*, i32*)* }
    > %vtbl.11 { {}*, {}*, i32(i32*, i32*)* }

    In this simplified example, these types are identical in the
    source but are emitted in this strange way.  These cannot be
    unified by the LLVM linker (nor in a post-processing step because
    they really are not identical, though their representations are).
    This analysis now unifies types like this by name.  This isn't
    always 100% safe (the types may have really been different in the
    source), but it is fine for our purposes and those cases are very
    rare.  It may be worth changing this post-processing unification
    to require strict physical compatibility.

    This canonicalization step just allows simple equality tests and
    assignments across compilation units to be considered.  It noticably
    improves at least libarchive.
Finalizer analysis improvements.

If an indirect call can be resolved to several targets,
treat the call as a finalizer for argument N if all of
the possible callees finalize argument N.
Add a few more finalizer tests based on libarchive
Resolved these FIXMEs