Simplifier fuzz testing, changed definition of div/mod

This pull request implements testing of the simplifier by generating random expressions and ensuring the simplifications of those expressions are equivalent.

In order to make the fuzz testing pass, a big change was required: division/modulus must always return a positive remainder. Previously we only guaranteed a positive remainder when the divisor was positive. This change was necessary to make bounds inference correct, which is necessary to make many simplifications correct.

The remainder of the changes are mostly small bug fixes found by the fuzz testing. 
I didn't forget this one, I'm still working on it. I'm struggling a bit because it's very difficult to include the fuzzing variables in the casted expressions, because their types will vary. Simply including a cast isn't reliable because the casts are often trivial and get simplified. The fundamental challenge is that variables can be used in various parts of the expression, some with and some without casts. This isn't impossible to fix, but I'm trying to figure out how to do it without making all this code a lot uglier.