Make taint analysis track foreach and argument unpacking?

[TysonAndre]

See https://psalm.dev/r/191a7078ad

Expected: TaintedInput warnings for all 3 echo statements (possibly impractical to generalize for array keys)
Observed: No issues were emitted

[psalm-github-bot]

I found these snippets:

https://psalm.dev/r/191a7078ad

<?php // --taint-analysis

// $_GET can contain arrays, e.g. example.php?foo[keyinput]=input
foreach ($_GET['foo'] as $key => $arg) {
    echo $key;
    echo $arg;
}

function test(...$args) {
    echo $args[0];
}
// Argument unpacking (but not varargs) seems to cause issues
test(...$_GET['other']);

Psalm output (using commit de85e7c):

No issues!