Add reference element reads

[ero-qt]

Depends on #152.
Part of #149.

Adds read_reference_array and read_reference_list, which hand back the elements' object addresses, plus read_string_object to read a string at one of those addresses (read_string is now just a dereference plus that). That makes string[] and List<string> readable, which the readers couldn't do until now.

Reference elements are pointers at the target's width, so a width claim through read_array compiles on either width and silently answers garbage addresses on the wrong one. These own the width instead. Null elements come back as null addresses at their positions; only a null collection reference refuses. Filtering nulls is the caller's one-liner, and positions matter if you're lining indices up against another array.

Custom-class elements work the same way: object address plus get_field_offset reads fields directly.