Fix remaining O(n*m) in cross-library resolution promotion path

Summary:
D106415307 fixed the O(n*m) unqualified-name scan in `resolve_cross_library_errors`'s error-*clearing* loop by adding the `globally_safe_funcs` index plus `is_call_verified_safe_indexed`. But the sibling call site — the function-*promotion* fixpoint (`promote_resolved_module_functions` -> `can_promote_missing_dep_function`) — was left calling the non-indexed `is_call_verified_safe` with `module_names` (every module). For each `UnsafeMissingDep` callee that does not resolve to a qualified module, that fallback scans all modules, so the promotion fixpoint stayed O(n*m).

This call site does not show up on the medium target but dominates on XL: on `confucius/server/ads_abtest:ads_abtest_server` (250,811 modules) `analyze-binary` was pinned single-threaded for 15+ minutes, with perf attributing ~95% of `resolve_cross_library_errors` to `is_call_verified_safe`.

Fix: route `can_promote_missing_dep_function` through the same `is_call_verified_safe_indexed` helper and `globally_safe_funcs` index that D106415307 already added. Because `module_names` covers every module and the index is kept in sync with promotions, the result is identical to the old unqualified scan but O(1) per callee instead of O(modules).

Result on XL (`ads_abtest_server`, 250,811 modules): `resolve_cross_library_errors` 15+ min -> 8.2s; `analyze-binary` total -> 14.3s.

Reviewed By: martindemello

Differential Revision: D107395893

fbshipit-source-id: 9761569f26f385c3ace7c68d1c4ea6ef679aa876

Author: brittanyrey

src/cache.rs

@@ -294,7 +294,12 @@ impl LibraryCache {
                 continue;
             };
             for (func_name, info) in fs {
-                if can_promote_missing_dep_function(info, module_names, func_safety_by_module) {
+                if can_promote_missing_dep_function(
+                    info,
+                    module_names,
+                    func_safety_by_module,
+                    globally_safe_funcs,
+                ) {
                     to_promote.push((module.name, func_name.clone()));
                 }
             }
@@ -552,14 +557,20 @@ fn can_promote_missing_dep_function(
     info: &FunctionSafetyInfo,
     module_names: &AHashSet<ModuleName>,
     func_safety_by_module: &HashMap<ModuleName, HashMap<String, FunctionSafetyInfo>>,
+    globally_safe_funcs: &AHashSet<String>,
 ) -> bool {
     info.verdict == FunctionSafety::UnsafeMissingDep
         // Promote only with positive evidence: a non-empty callee set,
         // all now verified safe. No record (e.g. a re-export-propagated
         // verdict) stays conservatively unsafe.
         && !info.missing_dep_callees.is_empty()
         && info.missing_dep_callees.iter().all(|callee| {
-            is_call_verified_safe(callee.as_str(), module_names, func_safety_by_module)
+            is_call_verified_safe_indexed(
+                callee.as_str(),
+                module_names,
+                func_safety_by_module,
+                globally_safe_funcs,
+            )
         })
 }