[analyzer] Extend ownership_returns attribute to cover output parameters

I'm currently working on adding clang memory ownership annotations to Apache Celix: https://github.com/apache/celix/pull/806

Is it possible to extend ownership_returns so that we can mark functions returning allocations through their output parameters?

I can work on this if some guidance is provided.

No source file, test, or entry point is named. Start by locating the analyzer handling for ownership_returns and its existing tests, then clarify how output parameters should be represented and what annotation behavior would demonstrate completion.

Written by the indexing model from the issue text.