Implement auto strong returned references

[kris-gaudel]

Closes #1714

#[flux::sig(fn(x: bool[true]))]
fn assert(_x: bool) {}

#[flux::sig(fn(x: &mut usize{v: v >= 10}) -> &mut usize{v: v >= 10})]
fn returns_a_mut(x: &mut usize) -> &mut usize {
    x
}

fn reads_agree() {
    let mut blah = 10;
    let tmp = returns_a_mut(&mut blah);
    let a = *tmp;
    let b = *tmp;
    assert(a == b) // now succeeds: before, `a` and `b` were unrelated values,
                   // each only known to satisfy `{v: v >= 10}`
}

fn read_after_write() {
    let mut blah = 10;
    let tmp = returns_a_mut(&mut blah);
    *tmp = 20; // a strong update, not a weak one
    assert(*tmp == 20)
}

#[flux::sig(fn(x: &mut usize{v: v >= 10}) -> (&mut usize{v: v >= 10}, usize[0]))]
fn tag(x: &mut usize) -> (&mut usize, usize) {
    (x, 0)
}

fn through_a_tuple() {
    let mut blah = 10;
    let (r, _n) = tag(&mut blah);
    *r = 20;
    assert(*r == 20) // references nested in a returned tuple or struct too
}

[nilehmann]

This PR introduces (new) unsoundness. The following is correctly rejected in main but accepted by this PR

#[flux::sig(fn(bool[true]))]
fn assert(_: bool) {}

#[flux::sig(fn(&mut usize{v: v > 0}) -> &mut usize{v: v > 0})]
fn id(x: &mut usize) -> &mut usize {
    x
}

fn bad() {
    let mut w = 1;
    let r = id(&mut w);
    let _a = [&mut *r];
    *r = 0;           
    assert(w > 0);   
}

[ranjitjhala]

(I haven't seen the code in the PR yet) but is the unsoundness because the effect of the *r = 0 is not "back-propagated" to the w after the r expires? Is there a way to only do this auto-strong IF the returned r "expires" at the END of the caller? (Also, @nilehmann what is the let _a = [&mut *r]; doing??)

[nilehmann]

I haven't reviewed the implementation, so I can't determine whether the issue is in the implementation or an existing unsoundness that's surfacing because there are more unfolds.

The let _a = [&mut *r] is triggering a ptr_to_ref on the unfolded location.