Expression-level coverage support

### Describe the desired feature

This should be a fairly simple task because source maps already return offset and length of the expression in the source. We do line coverage with this function, which computes the line number https://github.com/ethereum/hevm/blob/6c876b24b61d2c8f8b9919cc668db9a03e6496c8/src/EVM/Dapp.hs#L179-L183. Instead, we can just use offset and length from SrcMap and color accordingly. For now, we should do it only for html and think how to do it with text and lcov formats (not sure if this is even supported).

Start with the line-coverage function in EVM/Dapp.hs at the linked lines, then trace how SrcMap offset and length reach the HTML coverage output. Implement expression-range coloring for HTML only, and verify that the resulting report distinguishes covered and uncovered expressions; text and lcov formats are explicitly left for later consideration.

Written by the indexing model from the issue text.