[VectorCombine] Fix bailing out of the foldSingleElementStore with a freeze-pending index (#207702)

`foldSingleElementStore` calls `canScalarizeAccess` to decide whether a
single-element store can be scalarized. When the insert index is not a
constant, is provably in-bounds and may be poison, `canScalarizeAccess`
returns `SafeWithFreeze` and stashes a `ToFreeze` value that must later
be consumed by `freeze()` or cleared by `discard()`.

The bail-out for memory being modified between the load and store was
folded into same condition as the scalarizability check:

```cpp
auto ScalarizableIdx = canScalarizeAccess(...);
if (ScalarizableIdx.isUnsafe() || isMemModifiedBetween(...))
  return false;
```

When the index took the `SafeWithFreeze` path and memory was modified
between the load and the store, `isMemModifiedBetween` returns true and
hit `return false` while ScalarizableIdx still holds a live `ToFreeze`.

Its destructor then raises:
> Assertion !ToFreeze && "freeze() not called with ToFreeze being set"

### Fix
Move the `isMemModifiedBetween` bail-out above the `canScalarizeAccess`
call so the freeze-pending result is never constructed on the path where
we give up.