Permit perfect forwarding for `Fn` traits

Rewrite how the HRTB algorithm matches impls against obligations. Instead of impls providing higher-ranked trait-references, impls now once again only have early-bound regions. The skolemization checks are thus moved out into trait matching itself. This allows to implement "perfect forwarding" impls like those described in #19730. This PR builds on a previous PR that was already reviewed by @pnkfelix.

r? @pnkfelix 

Fixes #19730 
Wait, is this paragraph describing a new step in the algorithm, a step *after* the leak check failure described in the previous paragraph?  Or is this paragraph a semi-redundant description of the leak check already described?  The first sentence makes it sound like you might be describing something new, but the subsequent sentences sound very much the same as the previous discussion of the leak check.

Having said that, I actually *like* the inclusion of other example regions that would cause the leak check to fail, namely the "a leak is basically any attempt to relate a skloemized region to another skolemized region, or to any region that pre-existed the impl match."

So, assuming I am correct that this paragraph is semi-redundant, maybe I would like it best if you could merge these two paragraphs together, or move content around in some other way, to first introduce the intuitive description of was a leak is, and then following that by the formal definition of taint set and the example taint sets for the two examples.