Improve RSE when checking for "unsafe" references to collections.

Essentially, we need to observe that if a collection x is used to compute an
unsafe collection y, this doesn't prevent RSE on x provided that x's use to
compute y occurs positively in a notin clause -- it is likely that the second
use will also qualify for RSE, and hence we'll only do the deletion when the
conjunction of the two RSE conditions are satisfied.

Given that, we previously applied this rule for simple negations, e.g.,:

    foo <= bar.notin(baz)
    qux <= bar.notin(x)

Here, even if qux is an output collection, we can still apply RSE. However, we
didn't support more complex situations, like:

    qux <= (bar * k1).pairs.notin(k2)

Such expressions are now supported.