[LangRef] Clarify semantics of load metadata.

We need to explicitly state what happens when an invariant promised by
load metadata is violated at runtime, since it's come up repeatedly.

It's possible we want to specify that the result of the load is poison
in some cases, rather than undefined behavior, if the constraint is
violated. That would allow preserving the metadata when the load is
hoisted, but doesn't allow propagating metadata based on control flow.
We currently do transforms based on control flow for nonnull metadata
(in PromoteMemToReg).

Differential Revision: https://reviews.llvm.org/D47854

llvm-svn: 337325