feat(lint): detect external calls in loops

[figtracer]

Summary

• add the low-severity calls-loop lint
• detect external calls reachable from loops, including low-level calls, ETH send/transfer, contract/interface calls, this.foo(), and internal helpers called from a loop
• avoid flagging library-style member calls on non-contract values
• add lint documentation and UI coverage for flagged and ignored cases

[mablr]

ElementaryType::Address(_) pattern match is cleaner imo than to_abi_str() == "address"

[mablr]

It seems that receivers derived from returned values, mappings, or struct fields are missed: getRecipient().foo(), m[addr].foo(), s.target.foo()

[mattsse]

I found two false-negative cases worth addressing before this lands:

1. crates/lint/src/sol/low/calls_loop.rs ignores StmtKind::Placeholder, so calls executed through a modifier placeholder inside a loop are missed. For example, modifier twice() { for (...) { _; } } applied to function f() external twice { receiver.ping(0); } executes the external call in a loop, but the modifier pass sees only _ at loop depth > 0 and the function pass sees the call at loop depth 0. The reentrancy lint expands modifier placeholders; this lint likely needs similar handling.

2. is_internal_callable skips pure internal/private helpers, but pure helpers can still make external pure interface calls. I verified solc 0.8.30 accepts an internal pure helper that calls IReceiver.ping(...) external pure; if that helper is called from a loop, this lint won’t descend into it. This should either descend into pure helpers too or add coverage showing a deliberately narrower behavior.

[mattsse]

I found a couple of remaining edge cases that should be addressed before this lands.

[mattsse]

Explicit interface casts still appear to be missed here. is_contract_like only treats cast callees shaped as ExprKind::Type(...), but the existing ERC20 unchecked-transfer matcher handles interface casts as ExprKind::Ident([Res::Item(ItemId::Contract(_))]); IReceiver(target).ping(i) inside a loop would not pass this branch and will be skipped. Can we add that HIR shape plus a regression test? This is in the documented contract/interface-call scope.

[mattsse]

Low-level call names are emitted solely by member name here. Solidity allows library extension methods named call, delegatecall, or staticcall on non-address values; box.call() in a loop would be reported as an external low-level call even though the docs say library-style member calls on non-contract values are ignored. Please gate these names on an address-like base or add coverage for the intended behavior.