BoundsCheckOpts: merge OutputSpan.append capacity checks

[airspeedswift]

Sequential OutputSpan.append calls each emitted their own count < capacity check, since the inline _precondition lowered to cond_fail with no semantic apply for hoistFixedStorageBoundsChecksInBlock to recognise, and successive loads of the OutputSpan struct produced distinct SSA selves that fragmented the merge group.

Split the check into a _checkCanAppend helper tagged @_semantics("fixed_storage.check_capacity"). Teach the pass to look through load / load_borrow for the merge-group key when the call kind is CheckCapacity, and to substitute the first check's self when moving subsequent ones (sound because capacity is invariant; the helper reads no mutable fields). CheckIndex keying is unchanged so reads against mutable _count still behave correctly.

Also tighten cloneFixedStorageIndex to bail when the index expression depends on a memory read defined after the insertion point. Without this, an intervening @inout callee that mutates _count between two capacity checks could be skipped over: the cloned load of _count would read the pre-mutation value, the moved check would compare the stale count against capacity, and the trap that should fire would be silently elided.

Four sequential appends on the same inout OutputSpan now fold to one merged cond_fail covering all four indices, mirroring span_4_sum.

Resolves rdar://168782676 (OutputSpan does not hoist capacity check for multiple append calls)

[airspeedswift]

@swift-ci please smoke test

[airspeedswift]

with swiftlang/sourcekit-lsp#2666

@swift-ci Please smoke test Windows platform

[meg-gupta]

This early exit skips the conservative safety check inst->mayReadFromMemory() and incorrectly hoists bounds checks for:

sil @mutate_outputspan : $@convention(thin) (@inout OutputSpan<Int>) -> ()

// CHECK-LABEL: sil [ossa] @test_outputspan_check_capacity_across_mutation :
// CHECK: [[CHECK:%[0-9]+]] = function_ref @checkCapacity
// CHECK: apply [[CHECK]]
// CHECK: function_ref @mutate_outputspan
// CHECK: apply
// CHECK: apply [[CHECK]]
// CHECK-LABEL: } // end sil function 'test_outputspan_check_capacity_across_mutation'
sil [ossa] @test_outputspan_check_capacity_across_mutation : $@convention(thin) (@inout OutputSpan<Int>) -> () {
bb0(%0 : $*OutputSpan<Int>):
  %self1 = load_borrow %0 : $*OutputSpan<Int>
  %idx1_raw = integer_literal $Builtin.Int64, 0
  %idx1 = struct $Int (%idx1_raw : $Builtin.Int64)
  %check_fn = function_ref @checkCapacity : $@convention(method) (Int, @guaranteed OutputSpan<Int>) -> ()
  %c1 = apply %check_fn(%idx1, %self1) : $@convention(method) (Int, @guaranteed OutputSpan<Int>) -> ()
  end_borrow %self1 : $OutputSpan<Int>
  %mutate_fn = function_ref @mutate_outputspan : $@convention(thin) (@inout OutputSpan<Int>) -> ()
  %m = apply %mutate_fn(%0) : $@convention(thin) (@inout OutputSpan<Int>) -> ()
  %self2 = load_borrow %0 : $*OutputSpan<Int>
  %idx2_raw = integer_literal $Builtin.Int64, 1
  %idx2 = struct $Int (%idx2_raw : $Builtin.Int64)
  %c2 = apply %check_fn(%idx2, %self2) : $@convention(method) (Int, @guaranteed OutputSpan<Int>) -> ()
  end_borrow %self2 : $OutputSpan<Int>
  %t = tuple ()
  return %t : $() 
}

[meg-gupta]

inst->mayReadFromMemory() is also quite conservative and ideally we need to query alias analysis that any instruction we hoist over cannot mutate self of OutputSpan

[airspeedswift]

@swift-ci please test