Part of #7081: Fold remaining typeck's visit envs into visitor structs

r? anyone

Also got rid of a bit of `@mut` allocation.  (Though not the monster that is `@mut FnCtxt`; that case is documented already on #7081; if we attack it, it will probably be its own ticket, not part of #7081.)