Implement static analyzer checks for CHERIoT compartment calls

[resistor]

Some ideas:

• Make sure that every load or store is something that was passed as an argument across a call boundary was checked with check_pointer (with correct bounds).
• Make sure that no cross-compartment calls happen between a heap_claim_fast and a use of one of the claimed pointers.
• Make sure that anything passed to check_pointer is either checked as not being a heap object or is claimed.
• Make sure that claims are dropped.