SI-7872 Plug a variance exploit in refinement types

Refinement types are collapsed to a TypeTree with an original
during type checking; this was enough to evade variance validation
in refchecks.

This commit:

  - validates the original of `TypeTree`s in refchecks
  - changes VarianceValidator to recurse into:
    - the originals of `TypeTree`s
    - `TypTree` (to cover, e.g. `CompoundTypeTree` / `SelectFromTypeTree`)