Hmm... Lots of new results and quite a bad performance regression. Will convert this PR to a draft and investigate 👀.

I just took a look at the first few new results locally, so that I could see the full flow paths etc and assess.

• cpp/cleartext-storage-file on git-linux was already a result (with source credential.c line 207), this change adds an additional source for that result (imap-send.c line 955). The path I checked was long but looks plausible. TP I think.
• cpp/command-line-injection on vim__vim; 478 results all on the same line of code. I failed to find the new one. Not sure what's going on here.
• cpp/non-constant-format on vim__vim; this is not a path problem but involves macros; I think it's a false positive due to the underscore macro, which the query attempts to treat as a barrier / constant string. Have we accidentally worked around that?
• cpp/path-injection on Nelson-numerical-software__nelson; three new results; like cpp/cleartext-storage-file on git-linux, these are results we already had but an additional source is associated with each of them. All the new taint flows are similar to each other, and look OK except:
  • gram.c line 1410 writes the tainted data into yyval.extval but it's read on gram.c line 979 as yypt[-0].yyv.charpval, a different member of the union. Whether that's reasonable depends on how the union is used, I suppose. I lean towards yes, it's reasonable taint flow.
  • flow appears to go on names.c line 781 from stateno to extsymtab[-1-stateno].fextname, which seems a little dubious to me, I'm not sure.