return_to_param: handle "return get_foo(bar);"

return_to_param: handle "return get_foo(bar);"

Previously we could handle code like:

	struct foo *foo = get_foo(bar);
	...
	return foo;

This was because we stored the mapping in foo.  But for code like:

	return get_foo(bar);

We weren't saving the state anywhere, so we couldn't look it up.  With this
patch we save a kind of bogus state for the return and then we look it up.

I shifted some of the code in smatch_parse_call_math.c around to create a
helper function.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>