Parse &mut + ensures as &strg

[ranjitjhala]

This implements Niko Matsakis' suggestion to let us just write the update clause with an ensures instead of necessarily having to spell out &strg e.g. the below works (and you get an error if the relevant location is not a &mut.

#[flux::sig(fn (x: &mut i32[@n]) ensures x: i32[n+1])]
pub fn incr(x: &mut i32) {
    *x += 1;
}

#[flux::sig(fn () -> i32[11])]
pub fn client_safe() -> i32 {
    let mut p = 10;
    incr(&mut p);
    p
}

[ranjitjhala]

ping @nilehmann