Formal End-to-End Verification of Information-Flow Security for Complex Systems