[CaptureTracking] Volatile operations only capture address (#201316)
The fact that a volatile access was performed on a certain address is an
observable effect in the abstract machine, so volatile operations
capture the address of the accessed pointer. However, they do not
capture the provenance. This matches what we document in LangRef.
While I'm pretty sure that this models the semantics correctly, I'm
slightly concerned that we might be using the provenance capture here to
paper over some other issue, though nothing specific comes to mind (and
the test changes don't show anything problematic).