Taint propagation: `String.Concat(string, string, string)` (3-arg overload)

[JVBotelho]

Summary

Extend native taint propagation to the 3-argument String.Concat(string, string, string)
overload, following the pattern already shipped for Concat(string, string).

Background

ADR 006
("Scope discipline for v1") ships taint propagation for exactly one BCL method: the 2-arg
System.String::Concat(string, string). This issue widens that to the 3-arg overload. See
docs/good-first-issues.md for the shared explanation of how the three pieces below fit
together.

What changes

• RaspProfiler::IsV1PropagationTarget (src/Rasp.Native.Profiler/src/RaspProfiler.cpp:443-483):
  add a second signature match for Concat — 3 declared params, all ELEMENT_TYPE_STRING,
  DEFAULT calling convention (static, no HASTHIS).
• RaspTaintSensor (src/Rasp.Core/Context/RaspTaintSensor.cs:85-96): add a
  PropagateTaint(string? result, string? arg0, string? arg1, string? arg2) overload —
  marks result tainted if any of the three operands is tainted.
• RaspProfiler::DoJITCompilationStarted (RaspProfiler.cpp:606-648): resolve the new
  overload's MemberRef and call RewritePropagationProbe with operand count 3 for this
  target. No change needed to InsertPropagationCallBeforeRet (src/Rasp.Native.Profiler/src/ILRewriter.cpp:694-751)
  — all three arguments are strings and are the leading arguments, so ldarg.0..2 already
  works.

Acceptance criteria

• Existing 2-arg Concat(string, string) propagation is unaffected.
• 3-arg Concat(string, string, string) propagates taint from any tainted operand to the result.
• Unit test added in Rasp.Core.Tests/Context/RaspTaintSensorTests.cs for the new PropagateTaint overload.
• (Nice to have) extend src/Rasp.Native.Profiler/SmokeTest/Program.cs to also exercise the 3-arg overload.