[nullability] Use `Strict` `Environment` accessors in pointer_nullability_analysis.cc.

Because this reorders the checks for `isGLValue()` and `isAnyPointerType()` in
`transferFlowSensitiveCallExpr()`, we expand the test to check that we can take
the address of a returned reference-to-pointer and that we still see the correct
nullability "behind" the reference.

PiperOrigin-RevId: 534407057
diff --git a/nullability/test/function_calls.cc b/nullability/test/function_calls.cc
index 12f1310..9c52d02 100644
--- a/nullability/test/function_calls.cc
+++ b/nullability/test/function_calls.cc
@@ -81,6 +81,12 @@
       *makeNonnull();
       *makeNullable();  // [[unsafe]]
       *makeUnannotated();
+
+      // Check that we can take the address of the returned reference and still
+      // see the correct nullability "behind" the resulting pointer.
+      __assert_nullability<NK_nonnull, NK_nonnull>(&makeNonnull());
+      __assert_nullability<NK_nonnull, NK_nullable>(&makeNullable());
+      __assert_nullability<NK_nonnull, NK_unspecified>(&makeUnannotated());
     }
   )cc"));