Fix Trac #3831: blowup in SpecConstr

Fix Trac #3831: blowup in SpecConstr

It turned out that there were two bugs.  First, we were getting an
exponential number of specialisations when we had a deep nest of
join points.  See Note [Avoiding exponential blowup]. I fixed this
by dividing sc_count (in ScEnv) by the number of specialisations
when recursing.  Crude but effective.

Second, when making specialisations I was looking at the result of
applying specExpr to the RHS of the function, whereas I should have
been looking at the original RHS.  See Note [Specialise original
body].

There's a tantalising missed opportunity here, though.  In this
example (recorded as a test simplCore/should_compile/T3831), each join
point has *exactly one* call pattern, so we should really just
specialise for that alone, in which case there's zero code-blow-up.
In particular, we don't need the *original* RHS at all.  I need to think
more about how to exploit this.

But the blowup is now limited, so compiling terminfo with -O2 works again.