Rejig rejigConRes & friends, doing role checks in a second pass.

This commit is just a refactoring, intended to make the use of
rejigConRes (which sorts out the return types of GADT-like constructors)
less delicate. The idea is that, if we perform role checking in a
second top-level pass, we can use checkValidDataCon to check for
valid return types. Previously, checking roles would force the
rejigConRes thunk before we knew that rejigConRes was safe to call!