[LSR] New poison dependency when normalizing post-increment IV uses with variable stride

LSR rewrites post-increment IV uses by normalizing `E_post → E_pre = E_post - stride`. The invertibility check only validates SCEV structural equivalence and does not account for poison propagation.

For example, in this IR, if `%step` is poison, `%iv.next` is poison, but `%iv` remains 0, and the function returns 0:

```llvm
%iv.next = add i32 %iv, %step
...
%conv5 = zext i32 %iv to i64
```

is transformed to:

```llvm
%0 = sub i32 0, %step
...
%1 = add i32 %0, %iv.next
%iv.lcssa = phi i32 [ %1, %loop ]
%conv5 = zext i32 %iv.lcssa to i64
```

Now `%iv.lcssa` becomes poison when `%step` is poison, and the function returns poison.

Alive2 proof: https://alive2.llvm.org/ce/z/8UEKvn

Extracted from https://github.com/llvm/llvm-project/commit/3a57152d85e1b9f993871d550846f193ab91450c, cc @fhahn