Don't specify ce for MAY_BE_REF STATIC_PROP_FETCH

This is unlikely to matter in practice (due to the short lifetime),
but we should not specify a CE for a potential ref result.

Fixes oss-fuzz #46810.

Author: nikic

Zend/Optimizer/zend_inference.c

@@ -3455,6 +3455,7 @@ static zend_always_inline zend_result _zend_update_type_info(
 			if (opline->opcode != ZEND_FETCH_STATIC_PROP_R
 					&& opline->opcode != ZEND_FETCH_STATIC_PROP_IS) {
 				tmp |= MAY_BE_REF | MAY_BE_INDIRECT;
+				ce = NULL;
 			} else {
 				if (!result_may_be_separated(ssa, ssa_op)) {
 					tmp &= ~MAY_BE_RC1;