LogDrop Taint v1.24.0

LogDrop Taint v1.24.0

The leak engine reaches a released binary for the first time, and it is on by
default. Three new rules, one of which does not port to Android and says so.

SWIFT-LEAK-RETAIN-CYCLE CWE-401 two objects keeping each
other alive, one of them
something the framework
meant to destroy
SWIFT-LEAK-MANUAL-ALLOCATION-NOT-RELEASED CWE-401 memory taken and not given
back on some path out
SWIFT-STRUCT-TLS-VALIDATION-DISABLED CWE-295 a certificate accepted with
nothing having checked it

--leaks is on by default; --no-leaks switches it off. The decision was measured on
what enters the report of somebody who did not ask: two findings across six real
projects, both confirmed by hand, neither wrong, at about 24% more scan time.

A scan now says how many bodies it could not model rather than skipping them in
silence, projects are indexed in one pass instead of two, and extensions are
indexed at all.

Verified as a prerelease first: v1.24.0-alpha1 was downloaded through the customer
path, checksum and all, and found the same real cycle in NetNewsWire that the
local build finds.