C++: Better dataflow for function objects

[MathiasVP]

While adding tests for std::thread in #20016 I noticed that we failed to get dataflow in this example:

int x = source();
std::thread([](int y){
  sink(y);
}, x);

this turned out to be because we never properly added support for passing C++ function objects when we added support for function pointer resolution in #17788. This PR fixes that problem.

Commit-by-commit review recommended

[Copilot]

Pull Request Overview

This PR improves dataflow analysis for C++ function objects (functors) and lambda expressions by extending the existing function pointer resolution mechanism. The changes ensure that dataflow tracking works correctly when passing function objects as arguments, particularly in scenarios like std::thread constructors with lambda expressions.

Key changes:

• Enhanced lambda call handling to support both function pointers and functors
• Added detection for functor creation with and without constructors
• Extended test coverage to validate the improved dataflow behavior

Reviewed Changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll	Core implementation adding functor support to lambda call mechanism
cpp/ql/lib/semmle/code/cpp/ir/implementation/*/Instruction.qll	Added helper methods to UninitializedInstruction for accessing destination address
cpp/ql/test/library-tests/dataflow/taint-tests/thread.cpp	Added test case for lambda expression with std::thread
cpp/ql/test/library-tests/dataflow/external-models/test.cpp	Added comprehensive test cases for function object dataflow
cpp/ql/test/library-tests/dataflow/external-models/flow.ext.yml	Added external model for callWithArgument function
cpp/ql/src/change-notes/2025-07-11-function-objects.md	Release notes documenting the improvement

Comments suppressed due to low confidence (1)

cpp/ql/src/change-notes/2025-07-11-function-objects.md:1

• The filename contains a future date (2025-07-11) which seems inconsistent with the current timeframe. Consider using an appropriate date that reflects when this change will be released.

---

[jketema]

LGTM.