No non-pure check for predicate access arguments

[vfukala]

Consider

predicate p(flag: Bool)

method client() {
    inhale p(p(false))
}

Silver doesn't produce any consistency errors for this program. Silicon and Carbon then both crash on such an input.

I think there should be a consistency check that predicate access arguments are pure. Similarly to when we check that function arguments are pure.