Fix packet scatter to raw pointers

[jeongseok-meta]

Motivation

dr::scatter() supports packet values for Dr.Jit array targets and scalar
values for raw-pointer targets. Combining a packet value with a raw-pointer
target currently enters Target::scatter_packet_, which only exists for
Dr.Jit array targets. Pointer expressions such as .data() also cannot bind
to the current target parameter, so valid flat-buffer packet scatters fail to
compile.

This occurs in Momentum's rasterizer:
https://github.com/facebookresearch/momentum/blob/v0.1.114/momentum/rasterizer/image.cpp#L166

conda-forge currently carries patch 0004 for this behavior:
https://github.com/conda-forge/drjit-cpp-feedstock/blob/9a731565e61ff8d4373c79715ea59a606a05e2d2/recipe/patches/drjit/0004-Fix-scatter-for-raw-pointer-target.patch

Once this fix is included in an upstream Dr.Jit release, that feedstock patch
can be removed.

Changes

• Accept pointer expressions as scatter targets while preserving Dr.Jit array
  dispatch through the decayed target type.
• Expand packet indices for raw flat-buffer targets and reuse scalar scatter,
  including the requested reduction mode.
• Add runtime coverage for a padded Packet<float, 3> scattered into a packed
  raw buffer.
• Cover ordinary lvalue Dr.Jit array packet targets to prevent a forwarding
  reference regression.

Testing

• GCC 14.3, LLVM 21, Python 3.12, LLVM backend only
• Built drjit-python, drjit-copy-python-src, memop_ext, and call_ext
• python -m pytest tests/test_memop_ext.py -vv (8 passed)
• python -m pytest tests/test_call_ext.py -vv (128 passed)
• SSE4.2 header-only packed-offset probe with Packet<float, 3> (sizeof=16, passed)
• python -m py_compile tests/test_memop_ext.py
• git diff --check origin/master..HEAD