Ask ExpressionTypeResolverExtensions for the scope state type of an untracked expression

[dg]

Since 2.3, narrowing reads an expression's current type through MutatingScope::resolveScopeStateType(), which derives a property fetch's type from property reflection and skips ExpressionTypeResolverExtensions. For a property that only an extension knows (e.g. a @property-read tag on an interface, which ClassReflection ignores without __get), reflection finds nothing, so the narrowing starts from ErrorType:

assertType('string|null', $o->virtualProperty); // from the extension
if ($o->virtualProperty !== null) {
	assertType('string', $o->virtualProperty); // 2.3.0: *ERROR*
}

In 2.2 removeTypeFromExpression() started from getType(), which asks the extensions first. This makes the state read of an untracked expression ask them the same way resolveType() does; a tracked (already narrowed) type still wins without asking them.