Warning flags for unsigned operations (unsafe)

[Robert Dewar]

By the way, as always with suggested warnings, the best approach
is to implement the warning, and then apply it to a large body
of existing code. That gives a reasonable way of evaluating

a) if the warning is useful in the intended circumstances

b) if there is a problem with false positives

The burden for putting a warning in should be that yes, it
detects a significant number of suspicious cases, and it
does not generate too many false positives.