[analyzer] FN: null deref gets suppressed without defensive checks

Hi, I found a false negative in `core.CallAndMessage`.

CSA misses a null C++ receiver when the null value is returned by a trivial helper.

## Program

```cpp
class TestInstanceCall {
public:
void foo() {}
};

TestInstanceCall *get_null() { return 0; }

void test_ic_null() {
TestInstanceCall *p = get_null();
p->foo();
}
```

The receiver `p` is null at the call to `p->foo()`, so this is the same bug pattern as a direct `TestInstanceCall *p = 0; p->foo();`.

## Actual result

Re-running CSA on the reproducer emits no `core.CallAndMessage` result:

```text
No results.
```

No warning is emitted for the member call:

```cpp
p->foo();
```

## Expected result

CSA should report `core.CallAndMessage` for the member call through `p`, because `get_null()` always returns null.

## Verification

```sh
clang++ --analyze \
-Xclang -analyzer-checker=core.CallAndMessage \
-Xclang -analyzer-output=sarif \
-o callandmessage_get_null_receiver_fn.sarif \
callandmessage_get_null_receiver_fn.cpp
```

Version:

```text
clang version 24.0.0git (https://github.com/llvm/llvm-project.git 1cb7e838cd47ecad4050948c0c907ecb1f466ac3)
```

Start by running the provided clang++ --analyze command on the embedded C++ reproducer and inspect the core.CallAndMessage checker path. Compare this case with the direct null-pointer pattern described in the issue. Done means CSA emits a core.CallAndMessage warning for the member call through the null returned by get_null().

Written by the indexing model from the issue text.