check heap flags

we have rules for fetching the heap flags, but not how they are interpreted.

here's a reference: https://www.reverseengineering.app/en/techniques/heap-flags

5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a:0x1400016FB does this:

Start by locating the existing rules that fetch heap flags, then read the linked heap-flags reference to understand their interpretation. Compare the behavior shown for 5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a:0x1400016FB; done means rules cover the relevant heap-flag meanings and recognize that sample.

Written by the indexing model from the issue text.