From `IndexRangeTest.UseIndexForRef`:
```
stloc V_4(call GetSpan())
stloc S_19(ldloca V_4)
stloc V_2(call get_Length(ldloc S_19))
stloc V_3(call GetOffset(addressof System.Index(call GetIndex(ldc.i4 0)), ldloc V_2))
call UseRef(call get_Item(ldloc S_19, ldloc V_3))
stloc V_4(call GetSpan())
stloc S_30(ldloca V_4)
stloc V_2(binary.sub.i4(call get_Length(ldloc S_30), call GetInt(ldc.i4 0)))
call UseRef(call get_Item(ldloc S_30, ldloc V_2))
```
Due to `Span.get_Item` being a ref-return, it's possible that `ref V_4` is returned and passed into the `UseRef` method (this can't actually happen given Span's implementation, but it's a possible implementation of the get_Item type signature).
But we still need to split `V_4` -- it's a compiler-generated variable and needs to be inlined.
I think we can do this relatively simply by continuing to go up the ancestor instructions when we hit a ref-returning call. The recursive `DetermineAddressUse` call will check that there are no stores to `V_4` between the `get_Item` call and the point where the returned reference is used. Thus we still ensure that we don't split a variable while there is a live reference to it.
This initial commit only handles the trivial case where an Index or Range object is constructed.
The TODO portions of the test case show there are plenty of cases where where the C# compiler emits more complex code patterns that will require ILAst transforms.
If this attribute is in use, private/internal members lack nullability annotations.
Previously in such cases, we ended up inheriting the nullability from the `[NullableContext]`, which could cause us to display a misleading nullability for primary methods.
In debug builds, it could also trigger an assertion when trying to apply the "nullable reference type" marking to to value types.
Of note is that properties and events are a special case: they do not explicitly store Accessibility in metadata. For properties computing the accessibility requires decoding the signature (to find overridden base properties). So these two only check the declaring type's accessibility instead; private properties may still carry nullability despite `[NullablePublicOnly]`. However, the property accessors won't store nullability, so we need to read the `returnTypeAttributes` from the property itself.