Refactor save set to support namespacing

Previously, the save set did not namespace vars. As a result, if a var
was added into the save set in a parent query, expressions referring to
a var with the same name in a child query would not be evaluated.

With these changes, the save set includes the binding lists that can be
used to distinguish vars across queries. Because the vars are
namespaced, terms do not have to be plugged before calling Contains
which should reduce allocations and improve performance.

Since the binding lists are included in the structure now, callers must
provide root documents as refs instead of vars (since they are global
and not associated with a binding list.) This change resulted in a
small updates to the topdown example and rego package to provide `input`
as a ref instead of a var.

Lastly, this fix revealed an issue in the copy propagation
implementation which resulted in unsafe queries being emitted. If a
union-find root was added to the simple var/ref binding list and then
killed, the live var would be added back into the query unsafely. For
example, given the following query where x is the only live var and b is
picked as the union-find root:

a = input
b = a
x = b

The binding list would be a=>input, b=>input, x=>input. Each of these
expressions would be killed and then x=b would be added back into the
query without a reference to input.

Fixes #860

Signed-off-by: Torin Sandall <torinsandall@gmail.com>