[FIRRTL] Verify that lowerToBind is never nested

If a circuit contains a bind-under-bind, then this can't be lowered to SystemVerilog without transformation. It would be simpler (for now) to make any nested bind a verifier error.

E.g., the following should be a verifier error:

```mlir
firrtl.circuit "Foo" {
firrtl.module @Baz() {}
firrtl.module @Bar() {
firrtl.instance baz {lowerToBind} @Baz()
}
firrtl.module @Foo() {
firrtl.instance bar {lowerToBind} @Bar()
}
}
```

Start by locating the FIRRTL verifier logic for instances marked lowerToBind and the handling of nested bind-under-bind cases. Use the provided MLIR example to check that the nested case is rejected as a verifier error, while a non-nested bind remains valid.

Written by the indexing model from the issue text.