beginning to test higher-order function verification; proved a simple property about a List.map in listlemmas.fst