move Symexec.specialize_spec to Core.specialize_spec

This way it can be used by clients. It may be useful for them to know how specs
are specialized. It's used in llStar. Otherwise clients need to reimplement
this function.