Recommit "[LAA] Initial support for runtime checks with pointer selects."

This reverts commit 7aa8a678.

This version includes fixes to address issues uncovered after
the commit landed and discussed at D11448.

Those include:

* Limit select-traversal to selects inside the loop.
* Freeze pointers resulting from looking through selects to avoid
  branch-on-poison.