Swift: Fix defaultImplicitTaintRead on fields

[geoffw0]

Fix a bug in the defaultImplicitTaintRead mechanism for reading from field access paths at sinks. Assuming source() is a taint source and Mid.field is a sink (say, defined through models-as-data), consider:

class Base { }

class Mid : Base {
  var field : String
}

class Derived : Mid {
}

...

base.field = source() // case 1
mid.field = source() // case 2
derived.field = source() // case 3

• case 1 is impossible, as Base does not have a field.
• case 2 is the normal case. Taint flows from source() to the access of mid with an access path for .field. defaultImplicitTaintRead recognizes that the sink is an access to Mid and permits any field of Mid to be stripped off the access path, and we get a result.
• in case 3, once again taint flows from source() to the access of derived with an access path for .field. But this time defaultImplicitTaintRead sees that the sink is an access to Derived and permits any field of Derived to be stripped off the access path. That's not good enough, it needs to consider fields of base classes of Derived as well in order to find Mid.field.

In fact we had logic for this, but it was implemented the wrong way around.

TL;DR: getABaseType*() was in the wrong place. Moving it fixes some sinks.

I definitely want to do a DCA run on this one.

[geoffw0]

DCA run LGTM. There's an analysis speedup on the run, which is plausible given the nature of this PR - but more likely to be just wobble.

[MathiasVP]

Good catch! This LGTM!