Improve function pointer identification

[travitch]

There is currently a simple heuristic in macaw for identifying function pointers (to be used as additional roots for code discovery): any values written to memory that look like function pointers (i.e., within the bounds of an executable memory segment) are treated as function pointers.

This heuristic performs badly for PIC code, where most code addresses are small integer values.

We need to do something more sophisticated with some combination of pointer analysis and type inference. This will depend on implementing a solution to #298.