Let malloc possibly fail

[peterohanley]

brute-force polymorphism version of malloc that can fail.

[peterohanley]

This breaks every other use of malloc in our tree, and I don't have a way to solve having to drag the new Alloc along with us.

[septract]

I don't think this looks too bad - I've integrated it into #142 with a few modifications. One thing is that I've named this spec _malloc_canfail() so that it doesn't break anything else. Probably useful to have both.

I don't think there's any way of getting away from carrying the Alloc record with us. We might want to eventually have variant ownership predicates that indicate they are allocation sites as well. OwnedA(p), which is defined as Owned(p) and Alloc(p) etc.