FStar.Compiler.Sealed: add an internal sealed type

[mtzguido]

Motivated by #3210, this PR should make these bugs impossible.

We add an identity type internal to the compiler, called sealed, with
seal and unseal operations just like in user space. This type is
behind an interface so we must use seal and unseal correctly otherwise
the typechecker will reject it. This type constructor can now get an
embedding instance (e_sealed) and trigger automatically whenever needed.

[mtzguido]

Note: using a box type for the internal Sealed.sealed would almost work, except for the fact that we embed ranges (FStar.Compiler.Range.range) as a sealed thing (via e_range) but we do not expose that fact internally, which would take a bunch of churn to do. Maybe using sealed range everywhere in reflection/tactics would work, but also I don't see a big gain in moving to a box type.