fix "bivariant wf" bug in the NLL subtyping code

[nikomatsakis]

#53873 generalized the NLL subtyping code to handle subtyping and the like, but I think it is vulnerable to a similar flaw as the one from #41677. I didn't want to block that PR so I am filing this issue to follow-up.

[pnkfelix]

assigning self to this to try to help offload work from @nikomatsakis

[nikomatsakis]

I have yet to come up with a way to exercise this bug. I tried e.g. this example but we do catch it.

[nikomatsakis]

I'm demoting this to Release. I still think there is probably a bug here but since we don't even know how to reproduce it, it doesn't seem like an RC2 blocker.