JIT: Improve VNs arround Span length

```cs
static bool Test1(Span ok)
{
return new int[ok.Length].Length == ok.Length;
}
static bool Test2(int[] ok)
{
return new int[ok.Length].Length == ok.Length;
}
```
`Test1`:
```
cmp dword ptr [rax+0x08], ebx
sete al
movzx rax, al
```

`Test2`:
```
mov eax, 1
```

We fold the branch with array but not with span.
I believe this is important as I am hoping it will also fix the bounds check here:
```cs
static int[] GetPredecessors1(ReadOnlySpan blocks)
{
int[] preds = new int[blocks.Length];

for (int i = 0; i < blocks.Length; i++)
{
Consume(blocks[i]);
Consume(preds[i]); // bounds-check
}

return preds;

static extern void Consume(int a);
}
```

No source files or tests are named. Start by reproducing the two C# examples and inspecting the JIT-generated assembly, then trace the JIT's value-numbering treatment of Span.Length. Done means Test1 folds like Test2 and the intended bounds check in GetPredecessors1 is addressed.

Written by the indexing model from the issue text.