Fix an infinite loop in niFixTCvSubst

Trac Trac #14164 made GHC loop, a pretty serious error. It turned
out that Unify.niFixTCvSubst was looping forever, because we
had a substitution like

a :-> ....(b :: (c :: d))....
d :-> ...

We correctly recognised that d was free in the range of the
substitution, but then failed to apply it "deeeply enough"
to the range of the substiuttion, so d was /still/ free in
the range, and we kept on going.

Trac Trac #9106 was caused by a similar problem, but alas my
fix to Trac Trac #9106 was inadequate when the offending type
variable is more deeply buried. Urk.

This time I think I've fixed it! It's much more subtle
than I though, and it took most of a long train journey
to figure it out. I wrote a long note to explain:
Note [Finding the substitution fixpoint]