False positive: Multiplication result converted to larger type

**Description of the false positive**

[Monocypher](https://github.com/LoupVaillant/Monocypher/) implements, among other things, the Poly1305 MAC. CodeQL takes issue with a carefully-constructed sequence of multiplications, tripping [cpp/integer-multiplication-cast-to-long](https://codeql.github.com/codeql-query-help/cpp/cpp-integer-multiplication-cast-to-long/).

I asked the author about it in LoupVaillant/Monocypher#245, and you should check there for an analysis. I understand the short version to be:

* CodeQL is correct
* The sequence is carefully constructed to never overflow, and the author has a proof
* There are additional invariants enforced earlier that stop the overflow from being possible, that can't be expressed in C's type system
* Adding an explicit cast silences the warnings, but results in a measurable drop in performance (it converts a 64x32b multiplication to a 64x64b)

Ideally if there was a suppression mechanism, I would use it. As it is, I will likely simply leave a comment.

**Code samples or links to source code**

https://github.com/LoupVaillant/Monocypher/blob/master/src/monocypher.c#L352

**URL to the alert on GitHub code scanning (optional)**

The Security tab appears to have no alerts in it; the reports appear in openzfs/zfs#14249.