Make sepcomp/step_lemmas/safeN an inductive predicate.
(Previously, it was a fixpoint.)

This is to facilitate the safeN/external call case weakening necessary
to prove correctness of semax_call_external.

Why fixpoint->inductive predicate? Because the weaker safeN is no
longer structurally recursive on n. Program Fixpoint, etc., would
be even more invasive to the veric proofs.
Merge branch 'master' of https://github.com/PrincetonUniversity/VST