Add a coarse heap and aliasing abstraction #35

SSA is not sufficient for aliasing through containers and objects (docs/architecture.md §22):

a = []
b = a
b.append(user_input)
sink(a[0])

• AllocationSite, AbstractObject, HeapLocation, AliasSet (feat: heap and aliasing #48: abstract/heap.py, HeapAnalysis abstract.heap)
• Coarse abstraction first (feat: heap and aliasing #48: one object per allocation site, parameter, global, symbol or loaded field; elements and attributes locations, field-insensitive within each; flow-insensitive points-to)
• Taint through container mutation and object attributes (feat: heap and aliasing #48: stores, mutating method calls, loads and iteration on heap locations; TaintFacts.heap)
• mutations and side_effects in function summaries (feat: heap and aliasing #48: Mutation per parameter and field with dependencies and externals, mutated module globals; applied by callers, carried by the cache codec)

Split out of #27 once the module graph landed (#34).

Reference: docs/architecture.md §22 Heap and Aliasing, §19 Function Summaries.

Delivery: #48 (heap abstraction, heap-aware taint, mutation summaries)