[NFC + bugfix] Remove BreakTargetLocation from GUFA

[kripken]

Before, a br would send its value to a BreakTargetLocation. That would then be
linked to the target:

{ br's value } => BreakTargetLocation(target name) => { location of target }

This PR skips the middle:

{ br's value } => { location of target }

It just connects breaks directly to the targets. We can do that if we keep a
map of the targets as we go.

This is 2% faster as well as simplifies the code, as an NFC refactoring. But it
also fixes a bug: we have handling on ExpressionLocation that filters values as they
come in (they must accord with the expression's type). We were not doing
that on BreakTargetLocation, leading to an assert. Removing
BreakTargetLocation entirely is easier and better than adding filtering logic
for it.

Fixes #6955

[tlively]

Code looks good. Can we add a test for the bugfix?

[kripken]

Existing tests on filtering of expression content should cover this. The connection changes (that breaks go to the right place) are also heavily tested. With all that said, I would add a somewhat-redundant testcase here, but reducing the original testcase turns out to be quite difficult.