Fix &MEM_REF fold in expand_simple_operations

Fix &MEM_REF fold in expand_simple_operations

expand_simple_operations looks for expressions of the form

  &MEM_REF(ptr)compoment-refs

where component-refs include things like field names and array
indices.  It then folds that to:

  POINTER_PLUS_EXPR<ptr, offset>

where offset is the byte offset associated with component-refs.

In the testcase, the function was doing that even when ptr was a
capability and the result of the & wasn't, meaning that the type
on the POINTER_PLUS_EXPR dropped the capability from the result.

Fortunately this was caught by verify_gimple, as intended,
so it wasn't a silent error.