Implement bitmask checking.

Following on from commit 3ab136, implement the instrumentation side of constant flag/bitmask checking, e.g.:

// a call to 'foo' must include both the READ and WRITE flags
foo(flags(READ | WRITE)) == 0

// a call to 'foo' may only include the READ or WRITE flags
foo(bitmask(READ | WRITE)) == 0
Trivial: stop redefining NAME regex on every use.