Fix numeric coercion for property update expressions

[stonechoe]

I noticed a semantic mismatch in how property modify-and-assign operations are handled compared to the JavaScript specification.

When performing an increment operation on an object property whose value is not already numeric, the required coercion is not applied. As a result, operations such as obj.foo++ can produce behavior that diverges from standard JavaScript semantics.

This PR fixes the issue by propagating numeric context information through the modify-and-assign instrumentation and applying ToNumber coercion at runtime. A unit test has been added to capture this edge case and prevent regressions.

Example Demonstrating the Issue

This issue can be reproduced independently of analysis.js:

var foo = 'bar';
var obj = { foo: 'bar' };
foo++;
obj.foo++;

console.log(foo, obj.foo);
// `foo` prints NaN in both node and Jalangi.
// `obj.foo` prints NaN in node, but 'bar1' in Jalangi.

[msridhar]

LGTM, thanks!