[CSA] False negative: dereference of a globally initialized pointer beyond an array is missed

Hi, I found a false negative in `security.ArrayBound`.

## Program

```c
int values[10];
int *invalid = values + 11;

int read_invalid(void) {
return *invalid;
}
```

The global pointer is initialized beyond the end of `values`, and its dereference is invalid. CSA emits no `security.ArrayBound` diagnostic.

## CSA reproduction

```sh
clang --analyze \
-Xclang -analyzer-checker=security.ArrayBound \
global_one_past_array_pointer.c
```

## Comparison with related programs

A direct out-of-bounds array access is reported:

```c
int values[10];

int read_direct(void) {
return values[11]; // warning: out of bound access
}
```

The missed program moves the same constant out-of-bounds position into a global pointer initializer, then dereferences that pointer later:

```c
int values[10];
int *invalid = values + 11;

int read_invalid(void) {
return *invalid; // no warning
}
```

## Runtime confirmation

AddressSanitizer reports a global-buffer-overflow when the program dereferences the pointer.

## Expected result

The analyzer should preserve the array extent through a constant global pointer initializer and diagnose the later dereference.

## Verification

```text
clang version 24.0.0git (https://github.com/llvm/llvm-project.git 1cb7e838cd47ecad4050948c0c907ecb1f466ac3)
```

Start by running the provided clang --analyze command with the security.ArrayBound checker on the global_one_past_array_pointer.c reproducer, then trace how the checker handles the global pointer initializer and later dereference. Done means the invalid dereference produces a security.ArrayBound diagnostic while the direct in-bounds case remains unaffected.

Written by the indexing model from the issue text.