Emit null checks in compiler-synthesized inline-array helpers

[Copilot]

The compiler-synthesized inline-array helpers (InlineArrayElementRef, InlineArrayElementRefReadOnly, InlineArrayAsSpan, InlineArrayAsReadOnlySpan) form byrefs/spans from buffer without null checks. When buffer is a null byref (reachable via Unsafe.NullRef<T>() in safe code), this produces byrefs/spans over arbitrary memory at caller-controlled offsets, causing silent corruption instead of deterministic NRE.

Example

ref S s = ref Unsafe.NullRef<S>();
ref byte e = ref s[0xA00000];  // InlineArrayElementRef -> Unsafe.Add(ref <null>, index)
e = 1;                         // may or may not fault — expected: NRE

Span<byte> span = s;           // InlineArrayAsSpan -> MemoryMarshal.CreateSpan(ref <null>, length)
span[0xA00000] = 1;            // may or may not fault — expected: NRE

[InlineArray(134217720)]
public struct S { public byte F; }

Changes

Compiler infrastructure:

• Added System_NullReferenceException to WellKnownTypes (positioned after CSharp7Sentinel to preserve assertion invariants)
• Added Unsafe.IsNullRef<T> and NullReferenceException..ctor to WellKnownMember / WellKnownMembers

Code generation:
Each of the four helpers now emits if (Unsafe.IsNullRef(ref buffer)) throw new NullReferenceException(); before the unsafe operations:

• SynthesizedInlineArrayElementRefMethod
• SynthesizedInlineArrayElementRefReadOnlyMethod
• SynthesizedInlineArrayAsSpanMethod
• SynthesizedInlineArrayAsReadOnlySpanMethod

Tests:
Added four execution tests in InlineArrayTests.cs verifying NRE is thrown. IL verification skipped (block/if with ref-return doesn't satisfy strict verifier rules despite being valid IL).