SubtypingDiscoverer: Handle values flowing out of br_if

[kripken]

Consider

(br_if $target
  (value)
  (condition)
)

The value here must be a subtype of the thing the br_if flows into, and also of the block it targets - the value is sent twice, effectively, so it has two subtyping constraints. We were missing the value flowing out.