Ruby: Model more flow from splat arguments

[hmac]

Allow flow from a splat argument to a positional parameter in cases
where there are positional arguments left of the splat. For example:

def foo(x, y, z); end

foo(1, *[2, 3])

[hvitved]

I can see that this approach works, but it has the downside the each relevant callable will get n SynthSplatParameterNodes, where n is the number of possible splat argument positions. Instead, I think it would be better to adjust the indices at the call sites. That is, for a call

foo(x, *args)

we

• don't assign *arg a parameter position
• instead read each element out of *args into an intermediate node, and store from that node into SynthSplatArgumentNode, in this case subtracting 1 from each index.

[hmac]

@hvitved I put together an alternative approach that follows my interpretation of what you said, though it may not exactly match: #14090

The results look roughly the same except we catch this additional case:

def posargs(p1, *posargs)
  sink(posargs[0])
end

args = [1, taint(2)]
posargs(*args)

Analysis time for the alternative PR looks worse in general.

[hmac]

Superseded by #14090