Adds a small number of imprecise taint flow models. There's a lot more we could potentially do here, but lets start small for now:

• taint flow through methods that look like an "append" or "insert"; many of these will be on classes derived from Collection (which we can model and I think do model most of), but quite often these patterns are also copied in classes that do not derived from Collection. By using an imprecise model, we can catch the latter as well.
• taint flow through initializers with a "data" argument, which I'm pretty happy will inherit taint from an argument of that nature.

There's a contents / flow paths issue here - we only have flow path support on MAD flow models, not on QL flow models which these imprecise sinks have to be - so we can't have flow from the contents of the argument to the contents of the qualifier. That's why we don't catch the cases on lines 118 and 119 of the test where taint was introduced in the contents of the taintedArray argument rather than in taintedArray itself. I'm keen to hear thoughts on how we could solve this.