Class ParameterNodes::SynthHashSplatParameterNode

For all methods containing keyword parameters, we construct a synthesized (hidden) parameter node to contain all keyword arguments. This allows us to handle cases like

def foo(p1:, p2:)
  sink(p1)
  sink(p2)
end

args = {:p1 => taint(1), :p2 => taint(2) }
foo(**args)

by adding read steps out of the synthesized parameter node to the relevant keyword parameters.

Note that this will introduce a bit of redundancy in cases like

foo(p1: taint(1), p2: taint(2))

where direct keyword matching is possible, since we construct a synthesized hash splat argument (SynthHashSplatArgumentNode) at the call site, which means that taint(1) will flow into p1 both via normal keyword matching and via the synthesized nodes (and similarly for p2). However, this redundancy is OK since (a) it means that type-tracking through keyword arguments also works in most cases, (b) read/store steps can be avoided when direct keyword matching is possible, and hence access path limits are not a concern, and (c) since the synthesized nodes are hidden, the reported data-flow paths will be collapsed anyway.