mplace_field should use ptr_offset_inbounds

[RalfJung]

Currently, mplace_field uses ptr.ptr_offset to compute the new pointer. It should use self.ptr_offset_inbounds, or we should make sure that we cover our bases.

Some test cases (that all should be UB):

Test 1:

• Uses a field access to go out-of-bounds beyond the end, but just turn the result into a raw ptr.
• Use wrapping_offset to go back inbounds.
• Use the ptr.

Test 2:

• Use wrapping_offset to go out-of-bounds before the allocation
• Use field access to go back in-bounds
• Use the ptr

[RalfJung]

Duplicate of #447