rewrite T to checked type in malloc(sizeof(T))

[mwhicks1]

When converting this example:

#include <stdlib.h>
struct node { int x; };
void foo(void) {
  struct node **p = malloc(sizeof(struct node *));
}

the sizeof(struct node *) should get rewritten to sizeof(_Ptr<struct node>), but doesn't

#include <stdlib.h>
struct node { int x; };
void foo(void) {
  _Ptr<_Ptr<struct node>> p = malloc<_Ptr<struct node>>(sizeof(struct node *));
}

This is not obviously a bug, because Checked C's clang is happy to accept this, even in a checked region.