prove set-theoretic axiom of choice

inherited from HOL's
Merge remote-tracking branch 'origin/master' into complete_type_system
More work on the new type system restriction.

infer_eSound and infer_eComplete bothe defined (different) tenv_inv
relations, which was very confusing when both were in use in the same
goal in inferSound. Rename infer_eComplete one to tenv_invC