[ConstraintElimination] Defer removal of simplified ssub.with.overflow (#215135)
replaceSubOverflowUses erased the intrinsic as soon as it became dead.
That frees the intrinsic's operand Use array, but the worklist can still
hold UseCheck entries pointing into it, storing a now invalid pointer to
a Use *.
Instead of erasing the intrinsic in place, poison its arguments and push
it onto ToRemove.
PR: https://github.com/llvm/llvm-project/pull/215135