Generalized "dom-based" dynamic BCE to symbolic base + offset.

Rationale:
So far, if all others failed, BCE would use a dominator-based
dynamic deoptimization to eliminate bounds checks in e.g. a[0],
a[1], a[2], etc. This CL generalizes this to any symbolic base
with offset in e.g. a[base], a[base+1], etc. The runtime tests
(two for symbolic, one for constant) carefully account for
arithmetic wrap-around.

bug=26680114

Change-Id: I7432a200fd69791914ed776c77fa62567b5863c0