Fix lookupIdSubst call during RULE matching

As #20200 showed, there was a call to lookupIdSubst during RULE
matching, where the variable being looked up wasn't in the InScopeSet.

This patch fixes the problem at source, by dealing separately with
nested and non-nested binders.

As a result we can change the trace call in lookupIdSubst to a
proper panic -- if it happens, we really want to know.

(cherry picked from commit 149bce42)