Tree Borrows: improve protector end access child skipping

[royAmmerschuber]

Currently, if we do a protector release access we assume that any other subtree (including the main subtree) could be a child of the accessed node, meaning we conservatively don't update them based on the access.

This PR determines as accurately as possible (under the current model), which other subtrees could be children of the accessed tag.
This means we now accurately reflect:

• the main subtree is never a child of the accessed tag
• if the accessed tag doesn't have exposed children, then no other subtree is a child of it
• a subtree can only be a child of the accessed tag, if there exists an exposed child of the accessed tag with a tag less than the root of the subtree

[rustbot]

Thank you for contributing to Miri! A reviewer will take a look at your PR, typically within a week or two.
Please remember to not force-push to the PR branch except when you need to rebase due to a conflict or when the reviewer asks you for it.