Flatten does not handle `BrOn`.

Hi,

When running Binaryen with -O4 I get the following assertion failure:

$ wasm-opt --all-features a.out.wasm -O4 -o tmp.wasm
wasm-opt: ~/dev/cpp/binaryen/src/ir/block-utils.h:54: wasm::Expression* wasm::BlockUtils::simplifyToContents(wasm::Block*, T*, bool) [with T = wasm::Vacuum]: Assertion `block->type.isConcrete() && singleton->type == Type::unreachable' failed.
zsh: IOT instruction  wasm-opt --all-features a.out.wasm -O4

I'm on a recent version:

$ wasm-opt --version
wasm-opt version 119 (version_119-55-g7e1413902)

Running with -O3 does not give an error:

$ wasm-opt --all-features a.out.wasm -O3 -o tmp.wasm
$ ls | grep tmp
tmp.wasm

The source file is attached. I only have the binary sorry. I uploaded it as a .jpeg because otherwise GitHub won't let me... renaming it should be enough:

Start by reproducing the assertion with the attached binary using wasm-opt --all-features and -O4, then inspect src/ir/block-utils.h at the reported simplifyToContents assertion. Compare the -O3 and -O4 paths around Flatten and BrOn handling. Done means the supplied case no longer asserts under -O4 and the existing behavior remains valid under -O3.