Remaining cases of incorrect provenance replacement based on equalities

isPointerAlwaysReplaceable() still has a few remaining cases where it allows replacing pointers with potentially differing provenance:

* [ ] If the replacement is a dereferenceable constant global. This is not correct for at least two reasons: Because the dereferenceability check just checks 1 byte, even though some other offset/size may be accessed. And because of https://github.com/llvm/llvm-project/issues/220091. This special case is important for vtable assumptions emitted by clang.
* [ ] If the replacement is null. This is quite blatantly incorrect, because we're replacing with nullary provenance.
* [ ] If the use is in a ptrtoint instruction. This is incorrect because ptrtoint exposes provenance, and the exposed provenance changes. Replacement in ptrtoaddr is correct. This special case will likely become less relevant over time as migration to ptrtoaddr and the byte type proceeds.

Start at isPointerAlwaysReplaceable() and trace the three remaining cases described: dereferenceable constant globals, null replacements, and uses in ptrtoint versus ptrtoaddr. Confirm the provenance rules for each case and verify that replacement is no longer allowed where the issue identifies differing provenance, while valid ptrtoaddr behavior remains supported.

Written by the indexing model from the issue text.