Add RefinedType to track types more accurately.

In particular, we track whether:
* the type is exact, i.e., the value is of that particular
  class, not any of its subclasses
* the type is nullable.

The former is mostly useful for determining the target of
a dynamic call: if the type is exact, we can perform the
lookup as if it were a static call, which always gives 1
target, which means more inlining is possible.
Merge pull request #873 from sjrd/refined-types

Add RefinedType to track types more accurately.