AST: Add exactly-once execution semantics.
Add `ExecutionSemantics::Once` for function values that must be called exactly
once, along with an `isCalledOnce()` predicate on the ExtInfo types and the
function types. Print it as `@called(exactlyOnce)` and serialize it. Nothing
produces these semantics yet.
