An approximation with dominators doesn't really work well, and since
we have the fixpoint function for quite a few time there is no reason
not to implement it using the classical dataflow.

1. implements liveness analysis for subroutines and provides it
as [Sub.compute_liveness] which returns a fixed point solution to
the variable liveness property.

2. uses liveness to compute free variables when a subroutime is not
in the SSA form

3. Sub.to_graph now returns a fully connected graph with two
pseudo-nodes, [start], and [exit] (we keep doing every time we need to
do some graph computation, so let's make it official). This
pseudo-nodes are constants defined in the [Graphs.Tid] interface.

Context
=======

We used to rely on the dominators tree to compute the set of free
variables when the SSA form is not available. It was an optimization,
as by that time we didn't have the fixpoint function and didn't want
to compute SSA just for getting free vars. It was also returning an
underapproximation, rather than overapproximation (i.e., was a must free
analysis), which was fine with some existing uses of the
[Sub.free_vars] function, but wasn't sufficient/correct for other
uses, e.g., in the promiscuous mode we were relying on it to turn a
subroutine into a closed form, to prevent failures in runtime with
undefined variable (we probably could just define all vars used in the
program, but this is a different story). Since [Sub.free_vars] were
returning an under-approximation we still experiences some runtime
failures, which were halting our machines that resulted in non-visited
code and missing vulnerabilities.

The SSA transformation algorithm assumes that [Sub.to_graph] function
returns a graph with the set of nodes that are equal to the set of
term identifiers of the subroutine. This is no longer true, as this
set is now extended with two artifical nodes, start and exit,
therefore the algorithm was failing.

Now, it expects those artificial nodes and handles them correctly.