Fix a scoping bug in the Specialiser

This MR fixes #21828 (closed).

In the call to specLookupRule in already_covered, in specCalls, we need an in-scope set that includes the free vars of the arguments. But we simply were not guaranteeing that: did not include the rule_bndrs.

Easily fixed. I'm not sure how how this bug has lain for quite so long without biting us.

It's hard to trigger, so no test cases I'm afraid.