Debug Assert error for __arglist (not handled in ref safety analysis)

**Version Used**:

**Steps to Reproduce**:

Compile the following code with debug asserts enabled:
```csharp
using System;

namespace ICSharpCode.Decompiler.Tests.TestCases.Correctness
{
public class UndocumentedExpressions
{
static void Main(string[] args)
{
MakeTypedRef("abc");
VarArgs(1, __arglist());
VarArgs(__arglist(1));
VarArgs(1, __arglist("abc", 2, true));
VarArgs(1, __arglist((object)"abc", 2, true));
VarArgs(1, __arglist((short)1));
VarArgs(1, __arglist(ConsoleColor.Red));
}

public static void VarArgs(int normalArg, __arglist)
{
ArgIterator argIterator = new ArgIterator(__arglist);
Console.WriteLine("Called with {0} arguments", argIterator.GetRemainingCount());
int pos = 0;
while (argIterator.GetRemainingCount() > 0)
{
TypedReference tr = argIterator.GetNextArg();
object val;
try
{
val = __refvalue(tr, object);
}
catch (Exception ex)
{
val = ex.GetType().Name;
}
Console.WriteLine("{0} : {1} = {2}", pos++, __reftype(tr).Name, val);
}
}

public static void VarArgs(__arglist)
{
Console.WriteLine("The other varargs overload");
}

public static void MakeTypedRef(object o)
{
TypedReference tr = __makeref(o);
UndocumentedExpressions.AcceptTypedRef(tr);
}

private static void AcceptTypedRef(TypedReference tr)
{
Console.WriteLine("Value is: " + __refvalue(tr, object).ToString());
Console.WriteLine("Type is: " + __reftype(tr).Name);
__refvalue(tr, object) = 1;
}
}
}
```

**Expected Behavior**:
No error / no debug assert error

**Actual Behavior**:

```
Method Debug.Fail failed with 'ArgList expression of System.RuntimeArgumentHandle type
', and was translated to Microsoft.VisualStudio.TestPlatform.TestHost.DebugAssertException to avoid terminating the process hosting the test.

Stack Trace: 
RefSafetyAnalysis.GetValEscape(BoundExpression expr, UInt32 scopeOfTheContainingExpression) line 4281
RefSafetyAnalysis.g__inferDeclarationExpressionValEscape|32_0(<>c__DisplayClass32_0&) line 2700
RefSafetyAnalysis.CheckInvocationArgMixingWithUpdatedRules(SyntaxNode syntax, Symbol symbol, BoundExpression receiverOpt, ThreeState receiverIsSubjectToCloning, ImmutableArray`1 parameters, ImmutableArray`1 argsOpt, ImmutableArray`1 argRefKindsOpt, ImmutableArray`1 argsToParamsOpt, UInt32 scopeOfTheContainingExpression, BindingDiagnosticBag diagnostics) line 2687
RefSafetyAnalysis.CheckInvocationArgMixing(SyntaxNode syntax, Symbol symbol, BoundExpression receiverOpt, ThreeState receiverIsSubjectToCloning, ImmutableArray`1 parameters, ImmutableArray`1 argsOpt, ImmutableArray`1 argRefKindsOpt, ImmutableArray`1 argsToParamsOpt, UInt32 scopeOfTheContainingExpression, BindingDiagnosticBag diagnostics) line 2531
RefSafetyAnalysis.VisitObjectCreationExpressionBase(BoundObjectCreationExpressionBase node) line 767
RefSafetyAnalysis.VisitObjectCreationExpression(BoundObjectCreationExpression node) line 735
...
```

See missing case in: https://github.com/dotnet/roslyn/blob/9653ac597ce79454d4ebd3438ef64736733af325/src/Compilers/CSharp/Portable/Binder/Binder.ValueChecks.cs#L4281