WIP: Fix `ty_trait` variance inference bug

The lifetime parameter and mutability of a trait reference aren't
accounted for in variance inference pass.

Note: libserialize/json.rs won't be able to compile with this patch.