StaticAnalyzer: Avoid an unintentional copy

The range here isn't over references, so using `auto &` here incites a
copy. Switching to `auto *` would do, but we might as well list an
explicit type for clarity.

Found by -Wrange-loop-analysis.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@264071 91177308-0d34-0410-b5e6-96231b3b80d8