Support reffiness check in the middle of a region

Summary: Similar to CheckType vs GuardType, add a new instruction CheckRef to
do reffiness checks in the middle of a region.

Reviewed By: @swtaarrs

Differential Revision: D1527354