Bug 94201

Currently, structure check hoisting runs after the DFG optimization fixpoint. But when it modifies the IR (which is currently almost always, since array checks have been turned into structure checks), it requires the CFA to be rerun, outside of the fixpoint. Also, structure check hoisting requires that the post-fixpoint CSE fixes up redundant GetLocals introduced by hoisting. But there's no reason why structure check hoisting can't run before the optimization fixpoint. There's also no reason why structure check hoisting can't just clean up after itself to eliminate the need for CSE to worry about redundant GetLocals on non-captured variables.