Part of #7081: Fold remaining typeck's visit envs into visitor structs

Also got rid of a bit of `@mut` allocation.  (Though not the monster that is `@mut FnCtxt`)