Explicitly check that `extendSubst` preserves `InferM` invariant.
Explicitly check that `extendSubst` preserves `InferM` invariant.

We ensure that the bound `TVar`s in the current substitution are
always a subset of the bound `TVar`s in scope.

The regression test for #146 now fails earlier due to this check.
On the other hand, issue #323 never fails the `extendSubst` check.

GaloisInc/cryptol,GaloisInc/cryptol,GaloisInc/cryptol