[analyzer] Treat nullPtrType as a location type.

Fixes PR16584 (radar://14415223).