Just to demonstrate how things fit together, I've created
`SubtractSelf.qll` that adds a (hopefully sound) version of the test
extension that was already used in `extensibility.ql`.
It does so by first defining what a pointer dereference is (on the IR
`Instruction` level), and then using the array length analysis and the range
analysis together to prove that some of these pointer dereferences are safe.
