Fix several problems with join safety analysis for RSE.

* We neglected to record seal dependencies for RSE that was induced by a join in
  the first place. That is, given

    r1 <= (t1 * t2).pairs { ... }
    r2 <= (t2 * t3).pairs { ... }.notin(t4)

  We neglected to record the dependency between t2 and the t1*t2 join.

* Given multiple seal deps against the same collection, we tried to create
  multiple seal_done collections, resulting in errors.

* We neglected to consider that if a join is eligible for RSE, we don't need to
  also consider it for the join safety analysis. In other words, given

    r1 <= (t1 * t2).pairs { ... }.notin(t3)
    r2 <= (t2 * t4).pairs { ... }.notin(t5)

  The RSE logic will already ensure that we only reclaim from t2 when the
  conjunction of the RSE conditions have been met, so we needn't add extra
  checks.