Miscompilation due to wrong provenance when capabilities compare equal

[LawrenceEsswood]

Example:

https://cheri-compiler-explorer.cl.cam.ac.uk/z/x4qW5n

The compiler seems to think that if two capabilities compare equal then they can be substituted for each other. This would only be true if they had the same provenance (which they legally might not have in C; if one was a pointer to the byte past the last in an object, and the other a pointer to the first byte in an adjacent one).

[jrtc27]

#619 #561