[pulse] model C variadic out-parameters to fix false MEMORY_LEAK_C

[SuryanshSS1011]

Partially addresses #1937 (the MEMORY_LEAK_C false positive; the companion PULSE_UNINITIALIZED_VALUE false positives are left for follow-up, see Known limitations).

Problem

Pulse falsely reports MEMORY_LEAK_C when memory is allocated and stored through a variadic out-parameter, as in va_arg(a, char**); *p = malloc(...). The va_arg result is disconnected from the caller's argument, and trim_actuals_if_var_arg drops the variadic actuals at the interprocedural boundary, so there is nothing to reconnect the write to. A plain non-variadic char** out-parameter is handled correctly, so this is specific to va_arg.

Fix

This rides the existing specialization mechanism. A new variadic_actuals field on Specialization.Pulse.t carries the caller's extra actuals, PulseSpecialization.apply seeds them into a global bridge array during specialized re-analysis, and the va_arg model reads successive elements from it. The read is type-gated to pointer results so value-returning variadics such as a summing sum(int n, ...) are unaffected. Regression tests are added and the C pulse suite is otherwise unchanged.

Known limitations

The companion PULSE_UNINITIALIZED_VALUE false positives on the same out-parameters are not addressed here, since those need true caller-actual binding that the specialization's callee-formal-relative heap paths cannot carry, so the affected tests are marked with an FP_ prefix.