Read an out-array as callee-allocated only where the callee can allocate it

[estebanzimanyi]

An outputArrays entry says the callee allocates an array and writes its
address through the parameter, so a binding passes one pointer's worth of
storage and reads the array back from it. The inference admitted every non-const
** parameter beside a by-pointer count, and eight of the twenty-two it
admitted are the other contract: json_each, json_each_text, jsonb_each,
jsonb_each_text and their four pg_ twins fill an array the CALLER allocates.
A binding projecting them hands MEOS eight bytes for count pointers and then
reads the first pointer MEOS writes as the address of the array.

The element type is what separates the two, and the signatures already state it.
The callee writes *p = <the array>, an array of E is spelled E *, so a
callee-allocated parameter is spelled E **: TimestampTz **bins over the
by-value element TimestampTz, SpanSet ***periods over the element pointer
SpanSet *. Stripping both levels off Jsonb **values leaves Jsonb, a value
MEOS holds by reference and never by value in an array, so no array of that
element exists for MEOS to have made. The predicate now strips the two levels
and admits the parameter when what remains is a pointer or one of the by-value
scalars the module already names for input arrays.

Fourteen entries keep the classification; the eight that fill a caller's array
carry none, so a binding meets them as the plain ** argument they are. The
suite states both contracts against the pair that spells the same element two
ways, jsonb_each beside tdwithin_tgeoarr_tgeoarr, and the test that reads an
out-array apart from an input one takes temporal_time_split as its subject.