Represent type sources as a union of IRInstruction* and SSATmp*.

Summary: We currently use an SSATmp* to represent a type source, and if it's a
FramePtr then we treat it as a guard, otherwise we treat it as a
value. This is awkward because we chase FramePtr values to find the
appropriate guard for a local, when we could just have tracked the
correct guard in the first place. That and we would like to remove
FramePtr dests from {Guard,Check,Assert}Loc.

Reviewed By: @swtaarrs

Differential Revision: D1517845