StaticAnalyzer: Avoid an unintentional copy

The range here isn't over references, so using `auto &` here incites a
copy. Switching to `auto *` would do, but we might as well list an
explicit type for clarity.

Found by -Wrange-loop-analysis.

llvm-svn: 264071