LLMs Cannot Reliably Identify and Reason about Security Vulnerabilities (Yet?): A Comprehensive Evaluation, Framework, and Benchmarks