Always use image functions for QPs

[marcoeilers]

The current QP encoding is unsound for QPs that have trivial conditions and permission amounts that do not depend on the quantified variable(s), if the quantified variables are of type Int or Ref. Essentially, for such QPs, the encoding assumes that any receiver r can be mapped to some quantified value x s.t. the receiver e(x) is r, which is obviously not always the case.

This PR fixes that by enforcing the use of image functions for all QPs (like in Carbon), i.e., by adding an explicit condition that for any reference r we only have permission to it if it is in the image of function e(x). This was previously only done when quantifying over types that might be finite (see PR #666).

Additionally, this PR adjusts several parts in the QP and quasihavoc encoding that were previously not dealing with image functions correctly, which presumably wasn't noticed earlier because for many QPs image functions were not used, or because some tests may have relied on Silicon's unsoundness.

This fixes #833