Create security model registry and global taint engine #19

Framework and library plugins register facts; detectors reuse one global taint result.

• Security model registry: Source, Sink, Sanitizer keyed by canonical symbol, frozen into a ModelTable provided to the manager. Propagator and Framework models arrive with Phase 7 (flask.request.args -> Source(HTTP_INPUT), python.os.system -> Sink(COMMAND), html.escape -> Sanitizer(HTML))
• Global taint engine with bitset taint kinds (SQL, COMMAND, HTML, PATH, SSRF, ...); join is OUT = A | B
• No per-plugin taint engines; all detectors consume the same TaintAnalysis result
• Declared dependencies: SSA, CFG, the provided model table, CallGraph and FunctionSummaryAnalysis (feat: interprocedural taint through function summaries #29)

Reference: docs/architecture.md §15 Analysis Providers and Detectors, §16 Security Model Registry, §17 Global Taint Engine.

Delivery: #20