Fix infinite hang when analysing src/wp-includes/user.php in wordpress-develop

[ondrejmirtes]

Skip expensive type operations on complex union types to prevent exponential HasOffsetValueType growth.

When a variable has type array|object (common in WordPress) and the code does repeated
empty($data['key']) ternary checks, each check forks the object branch of the union into with/without
HasOffsetValueType variants. The array branch is absorbed by isSuperTypeOf, but the object branch is
not — creating 2^N union members after N checks. Combined with impure function calls (e.g. WordPress's
apply_filters) that create conditional expressions carrying this huge type, every subsequent
addTypeToExpression/removeTypeFromExpression call must operate on the massive union, causing analysis
to hang.

The fix introduces isComplexUnionType() which detects unions with >8 members containing
IntersectionType members — the signature of this combinatorial growth. Three call sites skip expensive
operations on such types:

• specifyExpressionType — skips HasOffsetValueType propagation to parent expressions
• addTypeToExpression — skips TypeCombinator::intersect on the existing type
• removeTypeFromExpression — skips TypeCombinator::remove on the existing type

Reproduces with WordPress's wp_insert_user() (471-line function with @param array|object $userdata, ~17
empty() checks, and ~15 impure apply_filters calls). Before: infinite hang. After: ~11 seconds.

Standalone benchmark included: array|object parameter + instanceof narrowing + empty() ternaries +
impure apply_filters calls. Before: >60s. After: 1.8s.