We now add a reference to TFunction to all TIntermAggregate nodes
where it is possible, including built-in ops. We also make sure
that internal TFunctions added in traversers have correct parameter
qualifiers.

This makes TLValueTrackingTraverser much simpler. Instead of storing
traversed functions or looking up builtin functions from the symbol
table, determining which function parameters are out parameters can
now be done simply by looking it up from the function symbol
associated with the aggregate node.

Symbol instances are no longer deleted when a symbol table level goes
out of scope, and TFunction destructor no longer clears the
parameters. They're all either statically allocated or pool allocated,
so this does not result in leaks.

TEST=angle_unittests
BUG=angleproject:2267

Change-Id: I57e5570da5b5a69a98a8778da3c2dc82b6284738
Reviewed-on: https://chromium-review.googlesource.com/881324
Commit-Queue: Olli Etuaho <oetuaho@nvidia.com>
Reviewed-by: Jamie Madill <jmadill@chromium.org>