Simplifier fuzz testing, changed definition of div/mod

This pull request implements testing of the simplifier by generating random expressions and ensuring the simplifications of those expressions are equivalent.

In order to make the fuzz testing pass, a big change was required: division/modulus must always return a positive remainder. Previously we only guaranteed a positive remainder when the divisor was positive. This change was necessary to make bounds inference correct, which is necessary to make many simplifications correct.

The remainder of the changes are mostly small bug fixes found by the fuzz testing. 
This introduces three copies of max_b, which might be a large expression. What about abs(max_b)?