Add some assertions to appease the static analyzer.

No functionality change.
[analyzer] Look through ExprWhenCleanups when trying to track a NULL.

Silences a few false positives in LLVM.
[analyzer] Include opcode in dumping a SymSymExpr.

For debugging use only; no functionality change.
[analyzer] Collect stats on the max # of bug reports in an equivalence class.

We discovered that sqlite3.c currently has 2600 reports in a single
equivalence class; it would be good to know if this is a recent
development or what.

(For the curious, the different reports in an equivalence class represent
the same bug found along different paths. When we're suppressing false
positives, we need to go through /every/ path to make sure there isn't a
valid path to a bug. This is a flaw in our after-the-fact suppression,
made worse by the fact that that function isn't particularly optimized.)
[analyzer] Make GRBugReporter::generatePathDiagnostic iterative, not recursive.

The previous generatePathDiagnostic() was intended to be tail-recursive,
restarting and trying again if a report was marked invalid. However:
 (1) this leaked all the cloned visitors, which weren't being deleted, and
 (2) this wasn't actually tail-recursive because some local variables had
     non-trivial destructors.

This was causing us to overflow the stack on inputs with large numbers of
reports in the same equivalence class, such as sqlite3.c. Being iterative
at least prevents us from blowing out the stack, but doesn't solve the
performance issue: suppressing thousands (yes, thousands) of paths in the
same equivalence class is expensive. I'm looking into that now.

<rdar://problem/13423498>