Taint labels are now at the argument level.

We previously allocated a taint label for each system call
object. To perform a more fine-grained analysis, we now label
each output argument with a different label, to be able to track
def/use relationships at the argument level.