C++: recognize assignment helpers returning reference parameters - #23109

Summary

Related to #7035.

The cpp/assignment-does-not-return-this query can report an assignment operator that returns helper(*this, other), even when the helper returns its destination parameter by reference on every reachable return.

Add a small reference-parameter summary for helpers with visible, non-virtual definitions. The summary requires a reference parameter and reference return type with matching base types, at least one reachable return, and direct accesses to the same parameter at every reachable return. At the call site, map the returned parameter to its argument, require matching unconverted argument and reference-base types, and use the existing dereferenceThis predicate to recognize the destination.

This handles free and static member helpers, instantiated templates, parameters at different positions, multiple explicit returns, and unreachable alternative returns. It does not infer general alias relationships or follow helper return expressions through casts, local aliases, nested calls, or conditional expressions. Virtual helpers and unavailable definitions remain conservative.

Validation

Validated with CodeQL CLI 2.27.4 against main at fbf9fca5ce7c3b64c2f5d719ea0444577850cb4a:

• The expanded AV Rule 82.qlref regression test passes, including inline expectations.
• Add 16 assignment-operator cases: 8 safe helper cases and 8 negative controls. Expanded baseline results contain 20 alerts; the candidate has 12. Only the 8 safe helper alerts are removed, while all 4 original results and all 8 new negative controls retain their locations and messages.
• Negative controls cover returning another parameter, differing return paths, conditional return expressions, by-value parameters and results, missing definitions, virtual overrides, and user-defined conversions.
• A separate minimal database extracted through real G++ compilation changes from 6 alerts to 3: the ordinary helper, template copy, and template move false positives disappear, while the 3 incorrect-return controls retain their locations and messages. That reproducer also has runtime identity checks from the reproduction stage.
• The added C++ fixture passes G++ C++11 syntax checking. Its deliberate by-value-parameter case produces the expected compiler warning about returning a reference to a local object and is not executed.
• QL compilation, QL formatting, and git diff --check pass.

The full repository suite, a full build of the original cxon project, and large-project evaluation were not run. Upstream CI has not yet run for this change.