Push list_transform's lambda body into ListLayout element projection - #10948

Summary

The list reader evaluates a list_transform lambda body inside the elements read, so it reads only the element fields the body uses. A body that can fail runs only on the elements of selected valid lists: the read takes the bounded path from #11272 and masks out null lists' elements, which can hold anything.

Changes

• split_list_transform (list/expr.rs): one list_transform($, λ), with the list read whole nowhere else, becomes λ's body over the elements and the rest of the expression over the lists of its values.
• project_all (list/reader.rs): a fallible body over a nullable list takes the bounded path, where select_lists keeps only selected valid lists.
• step_into_struct_field and Item are pub(crate) so the list reader can bind the body over the elements.

Testing

• list_transform_reads_only_what_its_body_uses: the segments each expression requests, nested lists and fallible bodies included.
• fallible_body_sees_only_selected_valid_lists: x + 1 over lists hiding MAX under nulls and in an unselected list.

Follow-up

• Push several list_transform lambdas into one ListLayout element read #11273 pushes several lambdas, and a lambda beside the whole list, into one read.