MatchBranchSimplication (a disabled mir-opt) is unsound

[pnkfelix]

Spawned off of PR #78151, which turned the mir-opt MatchBranchSimplification off by default.

I just want a dedicated issue for discussing the unsoundness identified there, and to track how resolve this bug in the mir-opt (and then maybe turn it back on again, if it can pay for its own cost, which it might not have done before...)

[tmiasko]

For the record, an example code that was being miscompiled:

fn main() {
    let a = &mut true;
    let b;
    match  *a {
        true => {
            *a = false;
            b = true;
            ()
        }
        _ => {
            *a = false;
            b = false;
            ()
        }
    };
    assert!(b);
}