When merging through a TokenFactor we need to check that the load may
be ordered such that no other aliasing memory operations may
happen. It is not sufficient to just check that the load is a member
of the chain token factor; we must check it is not an indirect check.
This fixes PR37826.
Instead of doing this predecessor check, could we just check that the load's chain has one use? I guess that misses some cases that could be transformed, but I'd like to avoid these expensive walks as much as possible.