glsl: Clone ir_loop::counter properly.

When non-NULL, the ir_loop::counter field always refers to a
previously declared ir_variable.  Therefore, when cloning an ir_loop,
we need to look up the corresponding clone of the ir_variable in the
hashtable.

Note: for consistency with the  safety, I've written the clone code so that if the ir_variable in question can't be found in the hashtable, we fall back on just copying the ir_variable pointer across.  In the absence of Mesa bugs, I don't believe this fallback code path will ever be executed, however it seems prudent to err on the safe side since

Fixes a segfault caused by use-after-free in Fragmentarium, where back-end compilation would try to visit an ir_loop whose counter had previously been freed. we don't do this (and instead we just copy over the ir_variable
pointer), then we risk use-after-free bugs, since the destination of
the clone will refer to an ir_variable from the source IR, which may
later be freed.

Bugzilla:
glsl: Refactor code for cloning ir_variable references.

No functional change.  This will allow bug 72026 to be fixed without
introducing code duplication.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=72026

Cc: "9.2" <mesa-stable@lists.freedesktop.org>
Cc: "10.0" <mesa-stable@lists.freedesktop.org>