thread template arguments through

This means the Typer class (a StmtVisitor) defines the type system. The rest
is just boilerplate, which is (hopefully!) customizable in case of emergency.
split taint tracking type system from base library
store types in a map
taint tracker: look up type of children

Still need to propagate through implicit casts.