C++: Refactor ExecTainted.ql to need concatenation

This makes ExecTainted report results only when the tainted value does
not become the start of the string which is eventually run as a shell
command. The theory is that those cases are likely to be deliberate, and
part of the expected threat model of the program (e.g. $CC in make).
This lines up better with the results I considered fixable true
positives in LGTM testing

cpp/ql/lib/semmle/code/cpp/commons/Printf.qll

@@ -253,6 +253,13 @@ class FormattingFunctionCall extends Expr {
     // format arguments must be known
     exists(getTarget().(FormattingFunction).getFirstFormatArgumentIndex())
   }
+
+  /**
+   * 
+   */
+  Expr getOutputArgument(boolean isStream) {
+    result = this.(Call).getArgument(this.(Call).getTarget().(FormattingFunction).getOutputParameterIndex(isStream))
+  }
 }
 
 /**