fix: guard null alias abstractions in return flow

[JLEnoch1]

Fixes #883

Summary

Fix null abstraction injection in AliasProblem and BackwardsAliasProblem return/call flow functions that causes NullPointerException in IFDSSolver.propagate(), killing the entire taint analysis.

Root cause: The duplicate-args branch calls processEdge(new PathEdge<>(d1, exitStmt, aliasAbs)) without checking for null. copyWithNewValue() has 3 code paths that return null. The normal path in the same function (line 708) contains an if (abs != null) check, which the duplicate-args branch missed.Closes #883

Problem (detailed)

AliasProblem.java return flow function, "two caller args same value" branch (line 712-727):

// BEFORE (original FlowDroid 2.15.1):
for (int argIndex = 0; !isReflectiveCallSite
        && argIndex < ie.getArgCount(); argIndex++) {
    if (i != argIndex && originalCallArg == ie.getArg(argIndex)) {
        AccessPath aliasAp = manager.getAccessPathFactory().copyWithNewValue(
                abs.getAccessPath(), paramLocals[argIndex],       // caller index → callee array
                abs.getAccessPath().getBaseType(), false);
        Abstraction aliasAbs = checkAbstraction(
                source.deriveNewAbstraction(aliasAp, (Stmt) exitStmt));
        manager.getMainSolver()                                   // no null check
                .processEdge(new PathEdge<>(d1, exitStmt, aliasAbs));
    }
}

Three bugs in this block:
1. paramLocals[argIndex] uses caller-side index for callee-side array (correct only for IdentityMapper)
2. No null check on aliasAp — copyWithNewValue() returns null in 3 paths
3. No null check on aliasAbs — deriveNewAbstraction(null) and checkAbstraction(null) return null

The same function's normal parameter mapping path (line 702-709) has if (abs != null). This branch omits it.

Changes

AliasProblem.java — return flow, duplicate-args branch
BackwardsAliasProblem.java — call flow
AliasProblem.java — ALL_PARAMS loop

Compatibility

- No breaking changes: the fix only adds defensive checks that skip invalid/null cases that previously caused NPE
- No behavioral change for valid inputs: when copyWithNewValue succeeds and aliasAbs is non-null, the same processEdge call occurs
- Skipped edges are correct to skip: null APs and primitive targets have no valid aliasing semantics