Simplifier fuzz testing, changed definition of div/mod

This pull request implements testing of the simplifier by generating random expressions and ensuring the simplifications of those expressions are equivalent.

In order to make the fuzz testing pass, a big change was required: division/modulus must always return a positive remainder. Previously we only guaranteed a positive remainder when the divisor was positive. This change was necessary to make bounds inference correct, which is necessary to make many simplifications correct.

The remainder of the changes are mostly small bug fixes found by the fuzz testing.