[TySan] False negative for int/short aliasing

```c
#define a() 0
int b, c, d;
short i;
int f1(int j) {
for (; 0 < 1;) {
f:
if (d == 0)
return 0;
if (c > 7)
goto f;
if (j > 0)
return 0;
if (!c) {
for (int g; g < 1;)
if (a() != 0)
return 0;
for (int h; h < 1; h++)
if (b == 0)
return 0;
}
}
return 1;
}
void aa(int j, int *k) {
short *a = (short *)k;
for (; (f1(j + 9) < a[0]) + j;) {
for (int e = 0; e < 1; e = 0 == i)
a = 0;
a += 4;
}
}
void aj(int j) {
int f = 0;
aa(j, &f);
}
int main() { aj(0); }
```

Taking the following snippet (from #187952), and then trying to run it under TySan:
```shell
clang -O2 small.c -o test -fsanitize=type && ./test
```

Does not diagnose anything. Presumably we should be diagnosing something though given in `aj` we declare an `int`, `f`, pass it by pointer to `aa`, and then try and access it through a `short *`.

Start by saving the reported C reproducer as small.c and running clang -O2 small.c -o test -fsanitize=type && ./test under TySan. Trace the int-to-short pointer access from aj through aa, determine why no diagnostic is emitted, and add coverage showing the expected aliasing diagnostic.

Written by the indexing model from the issue text.