C++: Rewrite cpp/user-controlled-null-termination-tainted away from DefaultTaintTracking

[MathiasVP]

This query logic in this query was kinda odd. The query starts by tracking flow from a subset of flow sources (the ones that can leave the variable with a non-zero terminated string) to a specific kind of VariableAccess (places where we know a zero-terminated string is expceted). That's all well and good. The problem is that, to weed out false positives, the query adds barrier logic to the query by reinventing a query-specific dataflow library. This dataflow library is implemented as a less-than-ideal transitive closure over the old exprDefinition predicate from DefinitionsAndUses library.

This PR rewrites the query to be a standard taint-tracking query. This is not totally what the old query was doing (since it used taint-tracking to track the flow, but used dataflow to implement a barrier), but I think this is within the spirit of the query.

There are a lot of lost results on MRVA. Most of the ones I've seen are due to fixed pointer conflation. There are a few new results (about 200 out of 23000 the result changes), and the ones I've looked at look like TP which was blocked by the queries incorrect handling of barriers.

I don't think we should spend too much time on this query as it's not part of any suite (it has no precision).

[MathiasVP]

I've looked through quite a lot of the lost results on vim (which went from having 2457 results to 0 results), and they all seem like fixed FPs 🎉. The previous FPs existed because the incorrect handling of barriers.