analyzer: look through casts in taint sanitization [PR112974,PR112975]

analyzer: look through casts in taint sanitization [PR112974,PR112975]

PR analyzer/112974 and PR analyzer/112975 record false positives
from the analyzer's taint detection where sanitization of the form

  if (VALUE CMP VALUE-OF-WIDER-TYPE)

happens, but wasn't being "noticed" by the taint checker, due to the
test being:

  (WIDER_TYPE)VALUE CMP VALUE-OF-WIDER-TYPE

at the gimple level, and thus taint_state_machine recording
sanitization of (WIDER_TYPE)VALUE, but not of VALUE.

Fix by stripping casts in taint_state_machine::on_condition so that
the state machine records sanitization of the underlying value.

gcc/analyzer/ChangeLog:
	PR analyzer/112974
	PR analyzer/112975
	* sm-taint.cc (taint_state_machine::on_condition): Strip away
	casts before considering LHS and RHS, to increase the chance of
	detecting places where sanitization of a value may have happened.

gcc/testsuite/ChangeLog:
	PR analyzer/112974
	PR analyzer/112975
	* gcc.dg/plugin/plugin.exp (plugin_test_list): Add
	taint-pr112974.c and taint-pr112975.c to analyzer_kernel_plugin.c.
	* gcc.dg/plugin/taint-pr112974.c: New test.
	* gcc.dg/plugin/taint-pr112975.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>