Commuting with |==> would have been interesting a bunch of times. But I still
don't see a way to commute with fancy updates, even mask-preserving ones.

Instances exist:

- unconditionally for
  * discrete CMRAs;
  * exclR;
  * agreeR.

- Then, CmraSwappable lifts through
  * optionR
  * prodR
  * gmapR
  * `authR A` isn't shown to be swappable in general, but it is
    discrete (hence swappable) whenever A is discrete. This is still not enough
    for invG, which uses authR over iProp.
  * iResR (tho we probably need a dependently-typed TCForall to write this more
    nicely).

- As a corollary, savedAnything and gen_heap are unconditionally swappable, and
  Coq can tell.
  This is basically documentation done through Coq instances.

- Lemma `ucmra_extend_included` helps prove unital CMRAs, such as gmap, are
  swappable.

We can swap those connectives on uPred M given `CmraSwappable M`.

Some instances:
- we can do swap without resources
- but we can't seem to lift CmraSwappable over gmap; !? It seems we'd also need
  the original CMRA axiom?

This commit introduces the following soundness statements:

- Soundness of pure propositions `⌜ φ ⌝%I → φ`.
- Soundness of later `(▷ P)%I → P`.

The old soundness statement, `(▷^n ⌜ φ ⌝)%I → φ` is now a derived form.

This is in preparation for coq/coq#9274.

Adding a hint without a database now triggers a deprecation warning in
Coq master (https://github.com/coq/coq/pull/8987).

The BI interface is then instantiated using these laws.  In particular, this
shows that the rules we claim to be admissible actually are.

This follows the proof at https://en.wikipedia.org/wiki/L%C3%B6b's_theorem#Proof_of_L%C3%B6b's_theorem

This is backwards-compatible; it desugars to a normal application on previous versions

Based on an earlier MR by @jung.

As suggested by @jjourdan, and proved in the ordered RA model by @amintimany.

This should solve the paradox in #149.

restriction in uPred_closed.