CPP: Fix false positives when a member variable is released via the target of a function pointer.

cpp/ql/src/jsf/4.10 Classes/AV Rule 79.ql

@@ -227,6 +227,11 @@ predicate leakedInSameMethod(Resource r, Expr acquire) {
         fc.getQualifier() = r.getAnAccess() or // e.g. `r->setOwner(this)`
         fc = acquire.getAChild*() // e.g. `r = new MyClass(this)`
       )
+    ) or exists(FunctionAccess fa, string kind |
+      // the address of a function that releases `r` is taken (and likely
+      // used to release `r` at some point).
+      r.acquisitionWithRequiredKind(acquire, kind) and
+      fa.getTarget() = r.getAReleaseExpr(kind).getEnclosingFunction()
     )
   )
 }