Fix interaction between defaultAdditionalTaintStep and defaultImplicitTaintRead

[geoffw0]

defaultImplicitTaintRead is described as follows:

  /**
   * Holds if taint flow configurations should allow implicit reads of `c` at sinks
   * and inputs to additional taint steps.
   */

However where we implement the functionality of defaultImplicitTaintRead (in allowImplicitRead, see the first commit), it is only applied at sinks and additional taint steps defined in the configuration. Additional taint steps defined via defaultAdditionalTaintStep are overlooked.

In Rust, one such defaultAdditionalTaintStep is for concatenation with +, and one such defaultImplicitTaintRead is for reading from reference content. As a result we've been missing flow in common cases like this:

let _ = string1 + &string2;

---

This PR is a draft (for now) because I'm nervous of unintended consequences, or whether this interaction was left out on purpose (for performance reasons perhaps). The change is in shared code and may affect all languages.

TODO:

• discuss
• fix tests
• DCA runs
• change note