JIT: retype some return expressions

JIT: retype some return expressions

The jit is fairly tolerant of byref/native int mismatches for inline arguments
and return values. And some of the new unsafe helpers do this kind of
reinterpretation across call boundaries as well. This sometimes leads the jit
to lose track of byrefs.

A general fix for this is likely somewhat involved. For now we simply detect if
we're about to lose track of a byref when substituting a particular kind of
return expression, and retype the expression to a byref.

Fixes #21051.