…apper constructions

  Restrict the pointer-arithmetic Unknown-downgrade in VisitBinaryOperator to
  pointer-typed variables only, so unrelated scalar compound-assignments no
  longer poison tracked results.

  Allow AnalyzeAllocType to also traverse record-typed (class/struct) return
  values, not just raw pointers, so wrapper types like std::optional<T*> get
  analyzed instead of short-circuiting to None.

  In handleExpr:
  - Unwrap unary operator* calls (e.g.  on an optional) to
    recurse into the wrapped value instead of falling back to a call analysis.
  - Detect nullptr/NULL literals directly via CXXNullPtrLiteralExpr/
    GNUNullExpr, since the existing CK_NullToPointer cast walk cannot see
    through a MaterializeTemporaryExpr (e.g. nullptr_t passed to optional's
    converting constructor).
  - Recognize implicit converting-constructor calls (ExprWithCleanups ->
    ImplicitCastExpr(CK_ConstructorConversion) -> CXXConstructExpr) and
    recurse into the constructor's argument, so New/Malloc/etc. tags
    propagate through implicit wrapping (e.g. ).
  - Add isNullOpt() to recognize std::nullopt/cpp::nullopt construction as
    AllocType::Null.

  Known limitation (documented via FIXME + test): optional's copy/move
  constructor is not a converting constructor, so copying an optional loses
  its tracked AllocType and reports None.

  Add FunctionReflection_GetAllocType coverage (func60-func69) for: implicit
  optional-wrapping of new, std::nullopt join behavior, default-constructed
  empty structs, direct/list-initialized plain wrapper structs, operator*
  unwrap (unary vs. binary), direct nullptr returns through optional, and
  pointer arithmetic inside a for-loop increment clause.