Implicitly recover missing subexpr nullability by synthesizing it; log details.

Up to now each expr transfer function that depends on the nullability of its
subexpr must deal with this being missing, and (typically) recovers by making
its own nullability "unspecified".

Instead, we can populate the *subexpr's* nullability as unspecified, and run the
usual logic. This makes the code simpler, and occasionally more precise
e.g. `&unhandled_expr` is [nonnull, unspecified, unspecified, ...].

Centralizing this logic gives us some space to produce actionable debug logs:

    [ RUN      ] PointerNullabilityTest.DerefNullPtr
	=== Missing child nullability: ===
	CXXNullPtrLiteralExpr 0x5babf7487d8 'nullptr_t'
	==================================
	=== Missing child nullability: ===
	IntegerLiteral 0x5babfde82d8 'int' 0
	==================================
	[       OK ] PointerNullabilityTest.DerefNullPtr (9 ms)

PiperOrigin-RevId: 502700687
diff --git a/nullability_verification/BUILD b/nullability_verification/BUILD
index e28cfaf..cf1c406 100644
--- a/nullability_verification/BUILD
+++ b/nullability_verification/BUILD
@@ -5,6 +5,7 @@
     hdrs = ["pointer_nullability_lattice.h"],
     deps = [
         "@absl//absl/container:flat_hash_map",
+        "@absl//absl/log:check",
         "@llvm-project//clang:analysis",
     ],
 )