Finds `%s` conversions whose argument can be bytes with no NUL after them, so that formatting it reads past the object they're in.

It reports only what it can show. The bytes the argument points to are a copy of a runtime number of bytes, the copy can fill the object they're in to its end, and nothing in the program writes a NUL into that object: every use of it is one this understands. Where the argument is a parameter, a caller shows it, and so on up. Anything else (an unknown use of the object, a copy it can't bound, a function filling it) makes it say nothing.

It also reports a call returning an unwritten buffer it was given, on a path no caller decides, in builds where the `#if`s on the way can hold.