[analyzer] Return an UnknownVal when we try to get the binding for a VLA.

This happens in C++ mode right at the declaration of a struct VLA;
MallocChecker sees a bind and tries to get see if it's an escaping bind.
It's likely that our handling of this is still incomplete, but it fixes a
crash on valid without disturbing anything else for now.

llvm-svn: 158587