The evaluate-builtins optimization isn't conservative

PlutusIR.Transform.EvaluateBuiltins turns ifThenElse True x y into x. That is not conservative: if y throws then the former term will throw and the latter one won't. So this is a bug that needs to be fixed. It wasn't discussed in the original PR.

More importantly, this looks like something that the proper property testing should catch. Look like a perfect opportunity for the PIR generators to show their power. So it'd be best to first write a failing property, then fix the bug.