Fix unsound SCCP for partial objects with hooks

[iluuu1994]

Fixes GH-21231

[arnaud-lb]

I was wondering if __set would cause unsoundness as well, but it doesn't. Looks like that objects with __set are considered escaped in zend_ssa_escape_analysis(), and as a result we skip this optimization. Should we do the same for hooks?

[arnaud-lb]

I would expect the optimization to be useful, especially if we can enable it on typed props, when the value assigns cleanly.

[arnaud-lb]

A similar issue happens with typed references:

#[AllowDynamicProperties]
class Foo {
}
class Bar {
    public object $x;
}

function test() {
    $bar = new Bar;
    $bar->x = new stdClass;
    $obj = new Foo;
    $obj->prop = &$bar->x;
    $obj->prop = 42;
    return $obj->prop;
}

var_dump(test()); // int(42); expected: TypeError: Cannot assign int to reference held by property Bar::$x of type object