scanf analysis: the 'a' length modifier is valid with a scanlist

Before r148025 we (accidentally) didn't check whether a length modifier is
appropriate for a scanlist, but now we do.

llvm-svn: 148026
diff --git a/clang/lib/Analysis/FormatString.cpp b/clang/lib/Analysis/FormatString.cpp
index 8e295aa..3519735 100644
--- a/clang/lib/Analysis/FormatString.cpp
+++ b/clang/lib/Analysis/FormatString.cpp
@@ -550,6 +550,7 @@
       switch (CS.getKind()) {
         case ConversionSpecifier::sArg:
         case ConversionSpecifier::SArg:
+        case ConversionSpecifier::ScanListArg:
           return true;
         default:
           return false;