0. define Map.map 'a 'b as an alias 'a -> 'b
1. define Set.set as an alias for 'a -> bool
2. rename HighOrd.func to (->)
3. remove HighOrd.pred
4. update drivers

except for modules/impset.mlw (because of Fset) and modules/mach/*
(because of program cloning), the standard library now typechecks.

This is still very much the work in progress. Many functions and
predicates have still to be converted to "let function" and
"let predicate". Here are some TODOs:
- do not require the return type for "val predicate", "val lemma", etc.
- do not require explicit variant for "let rec" if the code passes
  the termination check in Decl (see list.why)
- what should become "val ghost function" and what should stay just
  "function" (see array.mlw, matrix.mlw, string.mlw, etc)?
- some defined functions in algebra.why and relations.why had to be
  removed, so that they can be implemented with "let function" in
  int.mlw (since they are defined, they cannot be instantiated with
  let-functions). This seems too restrictive. One way out would be
  to authorise instantiation of defined functions (with a VC).
- should we keep the keyword "model"? reuse of "abstract" in types
  breaks syntax coloring ("abstract" requires closing "end" in
  programs but not in types; maybe we can drop that "end" again?).

Signed-off-by: Claude Marche <Claude.Marche@inria.fr>

Move of the transformations introduce_premises and intro_projections_counterexmp to the end of the driver.
Note that this requires putting meta "inline : no" for every projection function to the source file.
Otherwise, declarations projection functions are removed and the transformation intro_projections_counterexmp fails.

- generation in the makefile
- proofs done
Remove complex axioms from Pow2int in bv.why.
Add guards in rotates axioms in bv.why.

This should restore the current failing replay of nightly bench

If these are set, the prover is asked for counter-example and if the counter-example is got, it is displayed.

since results are better with the Why3 axiomatic version

this is of course unsafe, yet useful if you have proved absence of
overflows independently or if you are happy with a partial correctness
proof (that is, if there is no overflow then the postcondition holds)

this is work in progress; nothing plugged in yet

+ fixed wrong step limit in one session