fix[codegen]: cache result of iter eval

[charles-cooper]

What I did

fix for GHSA-h33q-mhmp-8p67 by always evaluating complex expressions before entry into the loop body. this is also a perf fix, since it moves the repeated evaluation into a one-time evaluation.

How I did it

How to verify it

Commit message

prior to this commit, multiple evaluation of a single expression is
possible in the iterator target of a for loop. while the iterator
expression cannot produce multiple writes, it can _consume_ side
effects produced in the loop body (e.g. read a storage variable
updated in the loop body) and thus lead to unexpected program
behavior. specifically, reads in iterators which contain an `IfExp`
(e.g. `for s: uint256 in ([read(), read()] if True else []))` would
issue one evaluation of the list `[read(), read()]` per loop iteration,
thus interleaving reads with writes in the loop body.

this commit fixes the issue by using `cache_when_complex` to enforce
evaluation of the iterator before entering the loop body.

this is incidentally also a performance fix, since it moves the
repeated evaluation into a one-time evaluation.

references:
- https://github.com/vyperlang/vyper/security/advisories/GHSA-h33q-mhmp-8p67

Description for the changelog

Cute Animal Picture

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.06%. Comparing base (ba66226) to head (fbdcf85).
Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4488   +/-   ##
=======================================
  Coverage   92.06%   92.06%           
=======================================
  Files         120      120           
  Lines       17329    17330    +1     
  Branches     2932     2932           
=======================================
+ Hits        15954    15955    +1     
  Misses        957      957           
  Partials      418      418           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[cyberthirst]

let's please link the PR to the advisory before merging

[cyberthirst]

should we update the docs for how the evaluation of the iter behaves?

[charles-cooper]

should we update the docs for how the evaluation of the iter behaves?

i don't think so, i think this is the expected behavior. we have the advisory for the old behavior.

[charles-cooper]

let's please link the PR to the advisory before merging

i think it's already linked?