wasm/planner: avoid ir.ScanStmt in ir.NotStmt (#3287)

* planner: optimize planRefData for all known vars, no rules

This was prompted by #3279: When planning an ir.ScanStmt inside of an
ir.NotStmt, the condition variable trick doesn't work: the scan may
never conclude successfully, but the code still runs into the condition
trap.

Now, not stmts should only ever have safe variables, so we should be
bypassing this by safely avoiding the scan.

* internal/ir: add fmt.Stringer to localOrConst interface

This way, the pretty-printed policy IR becomes a lot more transparent.

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>