[ty] Fix attribute access on Callable-bounded TypeVars (#24793)
When converting `type[T]` into the metatype for a concrete `T`, we were
doing `SubclassOfType::try_from_instance(...)`. But that method only
handles a subset of types: nominal types, `TypedDict`, etc., and falls
back to `type[Unknown]` for `Callable`, allowing arbitrary attribute
access.
We now use `Type::to_meta_type(...)`, which is more general and knows
how to handle `Callable`, etc.
I'm not yet certain why we weren't using this from the start.
Closes https://github.com/astral-sh/ty/issues/3303.
