Merged past vulnerability and provenance analyses.

Merged PastVulnerabilityAnalysis and ProvenanceAnalysis into VulnerabilityAnalysis. The provenance analysis is essentially injecting hypothetical vulnerabilities (and so putting both these into the same analysis class makes sense).
Moved vulnerability analysis code.

Moved past vulnerability and provenance analysis code to VulnerabilityAnalysis from SoaapPass. Also fixed bug in vulnerability analysis code, whereby we were not correctly checking if a function is a sandbox entrypoint.