Add call graph and interprocedural summaries #27

Interprocedural results use function summaries, never whole-program inlining.

• CallGraph from resolved symbols, imports and direct calls with KnownFunction / ExternalSymbol / UnknownTarget (feat: call graph and function summaries #28); type inference, framework models and PossibleTargets come later
• FunctionSummary { return_dependencies, return_externals, external_calls } (feat: call graph and function summaries #28, feat: interprocedural taint through function summaries #29); the taint engine derives return taints and parameter sinks from them (feat: interprocedural taint through function summaries #29); mutations and side effects wait on the heap abstraction
• ModuleGraph and SummaryIndex enabling whole-project analysis (feat: multi-file analysis with a module graph and project summaries #34): --check DIR, project symbols, fixpoint across modules with invalidation
• Fixpoint iteration over summaries across the call graph (feat: call graph and function summaries #28)
• Coarse heap and aliasing abstraction: moved to Add a coarse heap and aliasing abstraction #35

Reference: docs/architecture.md §19 Function Summaries, §20 Call Graph, §21 Multi-File Analysis, §22 Heap and Aliasing.

Delivery: #28 (call graph, summaries), #29 (interprocedural taint), #34 (module graph, project summaries)