Support vecs (1/2)

Support vecs (1/2)

Summary:
It is now possible to initialize an empty vec, add function pointers to it, and then upcast its elements. This is not field-sensitive analysis, so the solver will report the upcast of any element of a vec that may contains a function pointer of interest.

Since vecs are copy-on-write, a new version of the vec is created when an array assignment occurs. Hence, the walker creates and tracks a new entity after `array_get` on a vec, and the new test vec2.php should report a single upcast corresponding to the version of the vec with `f<>`.

Reviewed By: madgen

Differential Revision: D37837411

fbshipit-source-id: 12ca0d8769b9a2c4eec595d7e98ca56a8032a2e8