Broaden the in-scope sets for liftEnvSubst and composeTCvSubst
This patch fixes two distinct (but closely related) buglets that were uncovered in #22235 (closed):
-
liftEnvSubst
used an empty in-scope set, which was not wide enough to cover the variables in the range of the substitution. This patch fixes this by populating the in-scope set from the free variables in the range of the substitution. -
composeTCvSubst
applied the first substitution argument to the range of the second substitution argument, but the first substitution's in-scope set was not wide enough to cover the range of the second substutition. We similarly fix this issue in this patch by widening the first substitution's in-scope set before applying it.
Fixes #22235 (closed).