Disable declarations inside an optional even if in the first call pass

The first call pass might fail to resolve the name of a macro, e.g.

    (call does_not_exist (...))

If this is inside an optional, it should disable the optional and
everything inside it. However, we had an off by one error that made it
so that if something failed to resolve in the call 1 pass, then it would
disable the optional but not any of the statements inside it. So you if
you had the following:

  (optional opt
    (type t1)
    (call does_not_exist (...)))

then you could still resolve to t1 even though the optional was
disabled. And because t1 was in a disabled optional, it was never
written to the binary, which cause binary creation to fail with a very
poor error message. This patch fixes the off by one error so that
declarations inside an optional are propertly disabled if something
fails in the first call pass.

Note that the comparison for the first call pass in cil_resolve_ast() is
correct, since even if something fails in call1 and optionals are
disabled, there is no need to do all the resets since none of the things
being reset can change in call 1 or earlier.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>