Devirtualize calls dominated by a type assertion

Currently devirtualization kicks in after a cast to a type for which the method is sealed. Additionally if any type assertions are available (e.g. the a.GetType() == typeof(Exact) branch) the cast itself gets elided too.

However both seem to be required for the code to devirtualize. Instead, I would like to see the following work as well:

```cs
using System;
using System.Runtime.CompilerServices;
class C {
public int M(A a)
{
if (a.GetType() == typeof(B))
return a.Do();

return 2;
}
}

abstract class A
{
public abstract int Do();
}

sealed class B : A
{
public override int Do() => 1;
}
```

In this case `a.Do();` does not get devirtualized, as we are missing the explicit cast to B.