fixes calls search in reconstructor

[gitoleg]

Actually, this PR just restores the previous behavior, that was lost due to lack of tests and comments.

So this PR:

1. extends a list of roots with addresses of such CFG nodes, that don't have any input edges. The effect is noticeable in a case of pure code input, since the list of roots is empty in such case, and therefore the reconstructor will create just an empty symtab.
2. adds comments in the code to avoid losing such behavior in the future.
3. updated documentation for reconstructor in bap.mli, since it looks quite outdated

[ivg]

could you please update the comment, as provided in the comments, otherwise good to go.

[ivg]

Let's rephrase it as I'm afraid that we won't be able to decipher this later... today for example :)

A block is considered to be a function start if one of the following is true:
   - the block address belongs to the provided set of roots;
   - the block has no incoming edges

In general, all blocks should be reachable from the set of roots, thus a block without incoming edges should belong to the set of roots, so it might be tempting to say that the second clause is redundant. 

However, our implementation of the recursive descent disassembler can generate blocks that are not reachable from the initial set of roots. This can happen only if the set of roots is empty, which is treated as a special case, that instructs the disassembler to treat the first byte of the provided input as a root. 

Beyond being a questionable design decision, this behavior is actually just an example of a more general problem. The reconstructor and disassemblers could be called with different sets of roots. So, in general, we can't rely on the set of roots passed to the reconstructor for functions start classification.