SubtypingDiscoverer: Handle values flowing out of br_if

[kripken]

Consider

(br_if $target
  (value)
  (condition)
)

The value here must be a subtype of the thing the br_if flows into,
and also of the block it targets - the value is sent twice, effectively,
so it has two subtyping constraints. We were missing the value
flowing out.