Detect environment variable accesses

[oliverchang]

This isn't supported by Falco/sysdig, and would require some kind of userspace/libc interception.

[calebbrown]

Doing this via dynamic analysis will be hard as it requires instrumenting various runtimes to intercept the request.

This is quicker achieved by using static analysis.

However, eventually we may want dynamic analysis support as it will still detect access from obfuscated code.

[maxfisher-g]

Depends on #519