Detector for array length caching added

[bart1e]

This detector checks for loops that compare loop index against array.length and doesn't modify it (where array is a state array). Caching array.length in a local variable will save gas in such cases.

It is done by parsing each loop individually using function nodes. For each loop, it is checked whether it modifies array.length in some way (it can be done using push, pop or delete on the entire array).

For simplicity, the check for push and pop is done in one step, by iterating over irs of each node in the loop. I only check whether array.length is referenced there - the reason for that is explained in the code.

[bart1e]

@0xalpharush I have made the changes you requested.

In case of external function calls, I am also checking if the function called is pure or internal and if this is the case, I'm assuming that they don't modify an array. I have also added several new test cases to cover it.

[montyly]

This looks great, thanks @bart1e.

One caveat is that internal function call, or storage pointer will lead to false positive. For example

contract CacheArrayLength
{

    uint[] public array;

    function f() public
    {

        for (uint i = 0; i < array.length; i++)
        {
	        change(array);
        }
    }

    function change(uint[] storage array) internal{
	    array.pop();
    }


}

With pointer aliases it can even be more difficult. Maybe we should:

• Disable the result if the array is given as an internal function call argument
• Disable the result if a storage pointer is created with the array

Most likely both case are uncommon (and could actually be bugs - for a separate detector?), so I am ok to merge this PR for this week's release if we don't have the time to include them. What do you think @0xalpharush ?

[0xalpharush]

@montyly I think we can merge and follow up in a separate PR