Emit address of ret instructions/identified tail-calls in a function in JSON output data

[ayrtonm]

A dynamic tracing tool that will consume Anvill's output would benefit from having the address of ret instructions/tail-calls in a function as part of the JSON output data. This would help specify functions that will be instrumented more accurately since the tool needs the address of the first and last instructions. Currently the maximum address of a function is used as an approximation for where the last instruction is, but this isn't very accurate.

cc'ing @mshockwave