Assorted unboxed closure fixes

The most substantial change here is that we disallow capture-by-value `FnMut` closures from mutating upvars that are not declared `mut`, which is consistent with the behavior of procs and of other unboxed closure varieties, although it is notable that the equivalent desugaring would permit it since structure fields cannot have individual mutability.

This also fixes an ICE, upvars sometimes not being marked as used mutably, and some bad diagnostic messages.  There are still some improvements to be made here (#18330), but it's a longstanding issue that I'll try to address with a different PR.

Closes #18238
Closes #18335
Closes #18336

r? @pcwalton