JIT: (bug) Forward substitution drops a promoted struct's defining store

```csharp
using System;
using System.Runtime.CompilerServices;

class Program
{
struct S { public long A; public long B; public long C; }

[MethodImpl(MethodImplOptions.NoInlining)]
static long Combine(S s, long a, long b) => s.A + s.B + s.C + a + b;

[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.AggressiveOptimization)]
static long Test(S input)
{
S s = input;
input.A = 42;
long p = s.A;
return Combine(s, p, p);
}

static void Main() => Console.WriteLine(Test(new S { A = 1, B = 2, C = 3 }));
}
```

Expected output: `8`
Actual output: `6`

windows-x64, main @ a0b86b1e2adabe6a710daaacbcadf03ab0b3e0b0.

Goes away with `DOTNET_JitNoForwardSub=1`.