Make `-addcr` insert `#pragma CHECKED_SCOPE on` at top level and then `_Unchecked` as needed

[aaronjeline]

We should consider changing the behavior of -addcr, so that it no longer adds _Checked to top level declarations.
Instead, it would add a #pragma checked to the top of the file, and add _Unchecked annotations as necessary.
This is to fit in better with the porting workflow.

[john-h-kastner]

This behavior would be a better match for how I've been handling checked regions in my porting workflow. For most files, the whole file can be covered by the #pragma CHECKED_SCOPE on with no unchecked blocks. In others, such as sysutil.c, there are many small blocks of unchecked code. 3C should automate adding these unchecked regions.

[mattmccutchen-cci]

We have to be careful about letting #pragma CHECKED_SCOPE on affect #includes of unwritable files. The Checked C system headers handle this carefully, but #includes of headers of other external libraries (e.g., vsftpd -> OpenSSL) may be a problem.

(You all are probably sick of hearing from me about unwritable code by now... As soon as I saw this issue report, it rang a bell that I had thought about #pragma CHECKED_SCOPE on during my original pass of fixing 3C's handling of unwritable code.)

[aaronjeline]

As per discussions w/ Matt & John, here's a sketch of a design to avoid issues with #pragma CHECKED_SCOPE on in #include'd source.

Since most C files are organized a series of #includes followed by internal definitions, a good deal of cases can be handled by simply inserting the pragma directly directly before the first local decl.

The rest of the cases will be handled by inserted a #pragma CHECKED_SCOPE off and #pragma CHECKED_SCOPE on around the included source.

[mattmccutchen-cci]

What if a *.c file has a mix of #includes of writable files (i.e., project headers) and unwritable files (external library headers), followed by code? Would you delay the #pragma CHECKED_SCOPE on until the first definition in the *.c file and rely on the project headers containing their own #pragma CHECKED_SCOPE on to enforce that those declarations are fully checked? If so, the project headers probably need to do a #pragma CHECKED_SCOPE {push,pop} to ensure they don't have a side effect on a later #include of an unwritable header. So this gets a bit involved. 🙁

[aaronjeline]

sure, can and will do a push,pop.