ConstraintAnalysis: Fix mixed signed/unsigned comparisons

[kripken]

The IU64 idea was nice in theory - a single representation that includes both
signed and unsigned values - and it makes both of those comparisons work
in a simple and intuitive way, but it fails on mixed comparisons. When you have
x > C signed, and x < D unsigned, IU64 represents e.g. the number -1
twice, once signed and once unsigned. But what matters is the bit-pattern, in
the end, so we really need to represent it once.

To handle that, bite the bullet and implement Spans, a set of two Span
instances. An unsigned range is then a single Span, and a signed one,
fitted into the unsigned space, sometimes needs two. For example, x <= 100
signed turns into [0..100] and also [0x80000000, 0xffffffff], that is, small
positive numbers and also all negative numbers (and negative numbers, in
the unsigned space, are all those with the top bit set).

• Remove IU64 and add Spans.
• Use Spans where IU64 was used.
• Update tests. That part is unfortunately tedious, sorry about that - I'd
  understand if you skim it (I did go over it carefully + fuzzing + AI).

[tlively]

LGTM % very optional nit

[tlively]

Using nested initializer lists might be more readable, e.g. {{a, b}, {x, y}}. Then this could probably be std::initializer_list<Span>.

[kripken]

Good idea, and actually it turns out this "just works", c++ infers {a, b} must be a Span already. So we can just delete this constructor and rewrite the code. Done.