Query :: optional navigations null-ref protection logic doesn't work for some cases involving multiple optional navs and method calls

[maumar]

Found during investigation of #5481

model:

    public class Shipment
    {
        public int Id { get; set; }
        public string CarrierName { get; set; }
        public int? CargoReportId { get; set; }
        public Report CargoReport { get; set; }
        public int? AltCargoReportId { get; set; }
        public Report AltCargoReport { get; set; }
    }

    public class Report
    {
        public int Id { get; set; }
        public string Reference { get; set; }
    }

    public class MyContext : DbContext
    {
        public DbSet<Shipment> Shipments { get; set; }

        protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
        {
            optionsBuilder.UseSqlServer("Server=.;Database=Repro5613;Trusted_Connection=True;MultipleActiveResultSets=true;");
        }
    }

query:

                var query = ctx.Shipments
                     .Where(s => s.CargoReport.Reference.Contains("whatever")
                             || s.AltCargoReport.Reference.Contains("whatever"));

relevant query plan fragment:

(t3.Outer.Outer.Inner != null ? t3.Outer.Outer.Inner.Reference : null).Contains(
            value: whatever
        )

this will null ref if Outer.Outer.Inner is null

[maumar]

moving to 1.0.1 per triage comment in #6177

[divega]

Pulling from 1.0.1 into 1.1.0 because the fix has grown complex enough that we are not longer confident we should include it in a patch release.

cc @maumar @Eilon