Do not refresh clobber state for store address registers (#36)

[ricardojrdez]

Closes #36. Follow-up to #34 / #35.

Problem

The explicit-dst clobber refresh added to the ROP chain search in PR #35 zeroes the clobber counter of a gadget's dst whenever a step writes it, so later steps can reuse that register:

norm_dst = arch.normalize_reg(gad.dst) if gad.dst else None
saved_dst = side_effected[norm_dst] if norm_dst else 0
if saved_dst:
    side_effected[norm_dst] = 0

This is correct for register writes (mov dst, src, lc(dst), xchg dst, src), but wrong for store operations. A store st is mov [dst], src, so gad.dst holds the address base register ([rax] -> rax), which is read as an address, not written. Zeroing its clobber count marks it as freshly produced when it is not, so a stale clobber from an earlier step can be masked and an invalid chain produced. This is a correctness issue, not a regression (a store's dst was never protected by the side-effect guard).

Fix

Guard the refresh on whether the gadget actually writes dst. A new helper Gadget.writes_reg(normalized_reg) reports whether the gadget explicitly or implicitly writes a register (mirroring calculate_side_effects). The refresh now applies only when dst is genuinely written:

• register writes (mov, pop, xchg) -> dst in written regs -> refresh (unchanged behavior);
• stores (mov [dst], src) -> dst not written -> no refresh (fixed).

Tests

Adds test_store_dst_does_not_clear_clobbered_address_register, which is discriminating: it fails on the pre-fix code (an invalid chain is produced) and passes with the fix. It complements the existing test_explicit_dst_clears_clobbered_register (the register-write case). Full suite passes locally (103 tests) and covers Python 3.11, 3.12 and 3.13 in CI.