Implement spills at function call boundaries

Currently, we handle potential operand stack overflow in function bodies using the `TransformSpills` pass, which inserts spills (and corresponding reloads) at program points where too much operand stack space would be required to hold all of the live values.

However, we currently just raise an error if we ever observe a function signature with a parameter list that requires spills to even call it in the first place, as spills at call boundaries require consideration of ABI (primarily `call` vs `exec`). We haven't yet observed such functions, but it is just a matter of time.

To implement this, we want to use two strategies, dispatched on ABI:

* For functions whose ABI is any ABI _but_ the Wasm Canonical ABI, the function will be lowered to assume that the excess parameters (+ 1) were spilled to a contiguous set of the caller's locals (in reverse order as they appear in the parameter list), and replaced with a single pointer parameter to the first local. The lowering will move all of the spilled parameters into locals of the callee (to integrate nicely with the `TransformSpills` pass, i.e. to avoid redundant spills).
* For Canonical ABI functions, we cannot share memory between caller and callee. As a result, we must instead write spilled values to the advice map (and spill enough so that we can pass a commitment on the operand stack), and in the callee, pipe the spilled values to local memory of the callee and verify the contents match the commitment. A further complication with this ABI, is that we must use the type information provided by the Canonical ABI, to ensure what we're spilling represents a deep copy of each spilled value (unlike the other strategy, where we can simply shallow copy data).

This touches the following areas of the compiler (at time of writing):

* `Spills` analysis
* `TransformSpills` pass / `Spills` rewrite infrastructure
* `HirLowering` implementation of `Call` and `Exec`