Improve draft loop-creation pass -- still not sure it's correct though.
Several small fixes required for SQLiteBrowser:

* Squash pointers that are tentative, but can't be checked as we don't have an authoritative version, when they first appear as a call return (this already happened when they appeared at loads or memcpy instructions).
* Fix as-expected tests for invoke instruction return values.
* Don't discard loop invariants whose loop is not explored when that loop may be entered on failing paths.
* Note the type of allocations so it can be provided even if the allocation was not committed.
* Fix a case where the DOT printer called getCalledFunction in an uninitialised ShadowValue in some circumstances
* Expand the function-pointer path conditions to accept an arbitrary named value, possibly with an offset.
* Document the "access" syscall.