The checker already verifies that no non-destroy consuming users occur
after any `move_value`s corresponding to `consume` operators applied to
a value. There may, however, be _destroy_ users after it.
Previously, the checker did not shorten the lifetime from those destroys
up to `move_value`s that appear after those `move_value`s. The result
was that the value's lifetime didn't end at the `consume`.
Here, the checker is fixed to rewrite the lifetimes so that they both
end at `consume`s and also maintain their lexical lifetimes on paths
away from the `consume`s. This is done by using
`OwnedValueCanonicalization`/`CanonicalizeOSSALifetime`.
Specifically, it passes the `move_value`s that correspond to
source-level `consume`s as the `lexicalLifetimeEnds` to the
canonicalizer. Typically, the canonicalizer retracts the lexical
lifetime of the value from its destroys. When these `move_value`s are
specified, however, instead it retracts them from the lifetime boundary
obtained by maximizing the lifetime within its original lifetime while
maintaining the property that the lifetime ends at those `move_value`s.
rdar://113142446
