[BoundsSafety] passing negative value as count to function returning `counted_by` does not error

[hnrklssn]

Setting the length of a count to a known negative value is an error, but the error doesn't currently cover the case when the pointer is the return value of a function. Example (https://godbolt.org/z/15sfWEdhY):

int * __counted_by(len) foo(int len);
void bar(int * __counted_by(len) p, int len);

void baz(int * __counted_by(*len) *p, int *len) {
    *p = (void*)0; *len = -1;                              // error
}

void test() {
    int *p1 = foo(-1);                                     // no error!
    bar(p1, -1);                                           // error
    int len = -1; int * __counted_by(len) p2 = (void*)0;   // error
}

Related: rdar://80808704

[pandaaured]

Interested in this issue!