Fuzzer mutation: Use GLB to find the type to replace with

[kripken]

Mutation will find the necessary types of children, which can be more
general than the current child, and replace them. It did not handle
children with multiple constraints, however, like this:

(br_if $target
  (value)
  (condition)
)

The value here must be a subtype of the thing the br_if flows into,
and also of the block it targets - the value is sent twice, effectively,
so it has two subtyping constraints.

Add a GLBFinder utility for tihs, parallel to LUBFinder.