Require array_search()'s haystack argument before reading it

[SanderMuller]

Split out of #6226 as requested in #6226 (comment).

AssignHandler::shouldKeepList() recognizes $list[array_search($needle, $list)] as an offset that keeps an array a list. The branch accepted a call with one argument and then read the second one, so this aborts the analysis on current 2.2.x:

$list = [1, 2, 3];
$list[array_search($list)] = 4;

Internal error: PHPStan\Analyser\ExprHandler\AssignHandler::isSameVariable():
Argument #2 ($b) must be of type PhpParser\Node\Expr, null given,
called in src/Analyser/ExprHandler/AssignHandler.php on line 1916

The haystack is array_search()'s second argument, so requiring two is what the branch already assumed. The call stays malformed - it is now reported as Function array_search invoked with 1 parameter, 2-3 required. instead of ending the run.

A single unpacked argument counts as one argument too, so $list[array_search(...$args)] = 4; reached the same read and is covered as well.

I checked the neighbouring heuristics for the same off-by-one: every other getArgs()[N] in the file is guarded by a count of at least N + 1, and a sweep over src/ for an argument index accessed under a weaker count guard turned up no other case that can be reached (the count() ones bail out on an empty argument list before getting there).

tests/PHPStan/Analyser/nsrt/array-search-offset-argument-count.php holds both cases; with the guard reverted the test errors with the TypeError above. Full suite, self-analysis and phpcs are green.

[staabm]

thank you