Simplifier fuzz testing, changed definition of div/mod

This pull request implements testing of the simplifier by generating random expressions and ensuring the simplifications of those expressions are equivalent.

In order to make the fuzz testing pass, a big change was required: division/modulus must always return a positive remainder. Previously we only guaranteed a positive remainder when the divisor was positive. This change was necessary to make bounds inference correct, which is necessary to make many simplifications correct.

The remainder of the changes are mostly small bug fixes found by the fuzz testing. 
If I use abs(max_b), I have to cast it back to a (possibly signed) type, since abs(intN) -> uintN. I remember there being some reason why this didn't work at one point, let me try again. I'll either fix it or put a comment explaining why it doesn't work.