JIT: (bug) MD-array `Set` elides the array covariance check when the element type is itself an array

`impArrayAccessIntrinsic` treats a sealed reference element type as proof that an MD-array `Set` needs no covariance check. Array element types are sealed but covariant, so an inline `Set` can store an incompatible array reference into a covariant MD array.

### Minimal Repro

```csharp
using System;
using System.Runtime.CompilerServices;

class Program
{
[MethodImpl(MethodImplOptions.NoInlining)]
static void Test(object[,][] a, object[] v) => a[0, 0] = v;

static void Main()
{
string[,][] s = new string[1, 1][];
try
{
Test(s, new object[] { 42 });
string bad = s[0, 0][0];
Console.WriteLine("no exception; bad.Length = " + bad.Length);
}
catch (ArrayTypeMismatchException)
{
Console.WriteLine("ArrayTypeMismatchException");
}
}
}
```

Requires `DOTNET_TieredCompilation=0`.

### Expected

```
ArrayTypeMismatchException
```

### Actual

```
no exception; bad.Length = 42
```

The `string` reference actually points at a boxed `int`, so reading `bad.Length` reads the boxed payload as a string length.

### Notes

`impArrayAccessIntrinsic` in `src\coreclr\jit\importercalls.cpp` uses `CORINFO_FLG_FINAL` on `actualElemClsHnd` to prove no runtime covariance check is needed.
Array types satisfy `CORINFO_FLG_FINAL` but are still covariant, so the inline expansion emits only a range check and write barrier instead of the covariance-checking `Set`/`ARRADDR_ST` path.
With `DOTNET_JITMinOpts=1`, the intrinsic is rejected and the real `Set` stub correctly throws `ArrayTypeMismatchException`.
Reproduces on released .NET 10.0.12 as well as `main` Checked.

Reproduce the C# example with DOTNET_TieredCompilation=0, then read impArrayAccessIntrinsic in src\coreclr\jit\importercalls.cpp and compare its inline MD-array Set path with the covariance-checking Set/ARRADDR_ST path. Done means the repro throws ArrayTypeMismatchException on main, including for nested array element types.

Written by the indexing model from the issue text.