[SizzleUnrlsd]

Summary

Second Phase 6 item of docs/architecture.md: the global taint engine consumes function summaries (§17, §19). Nothing is inlined.

• Acceptance tests first (test: define interprocedural taint behavior), implementation follows.
• TaintAnalysis now requires CallGraphAnalysis and SummaryAnalysis. At a call to a known function it maps the callee's parameter dependencies onto the actual arguments and keywords: a tainted argument whose parameter reaches a sink in the callee, directly or through further known calls, becomes a TaintFlow at the call site, recorded with the function it went through (through) and the sink's own location (sink_location). The result of a known call carries the taint of the arguments its return value depends on, plus the taint of any source the callee returns.
• Summaries gain return_externals, the external symbols whose results the return value depends on, still without any security knowledge; the taint engine decides which of them are sources.
• Flows are deduplicated, so recursion reports a call site once. Sanitizing before the call, unsupported callees (conservative) and keyword arguments are covered.
• Detectors append through <function> to the message and record through and sink_line in the finding metadata.

Example: execute(read()) where read returns input() and execute calls os.system is now a command injection at the execute(...) line, reported through execute.

Not in this PR: cross-file analysis (ModuleGraph), method and attribute targets, heap and aliasing.

Part of #27. Completes the "CallGraph and FunctionSummaryAnalysis are added in Phase 6" note of #19.