Instrumentation of built-ins for data flow analysis

Built-ins hide certain data flow from us, so we need to explicitely describe it.

# Notes

* Most of the relevant code is runtime monkey patching, found in https://github.com/Domiii/dbux/tree/slicing/dbux-runtime/src/builtIns (slicing branch)
* Reference: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects

# Built-ins that definitely need instrumentation

* [x] Array
* [x] Object
* [x] `Object.assign`
* `Warning: Note that Object.assign() triggers setters, whereas the spread operator doesn't!`
* Source: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Object_initializer#spread_properties
* [x] Map
* [x] Set
* [ ] {Shared}ArrayBuffer
* [ ] TypedArray
* [ ] Weak{Ref,Map,Set}

# More Built-ins that can benefit from instrumentation

* Atomics
* Intl
* Proxy
* Reflect
* WebAssembly

# DOM

* Reference: https://developer.mozilla.org/en-US/docs/Web/API/Document_Object_Model

# Node

* Reference: https://nodejs.org/docs/latest/api/

# Other environment built-ins?

# Unsorted Notes

* Q: Can we do some heuristic approach for any function that we know is not instrumented? (especially untracked library functions?)
* A: Yes. Implemented.

* Partial effect capturing
* Annotate built-ins with value-creating effects?
* Some simple generalizations:
* Check if return value of function is reference type, and reference was not recorded before
* `event` objects need some tracking
* at least track `event.target`
* Some basic DOM wrapper?
* event handlers need to track `event` objects