typeintersect: fix potential free TypeVar caused by chained inner var.

Noticed when working on 02f27c2.
The substitution and re-sorting of inner vars are incomplete on master.
This commit re-organized the code by:
1. Flatten the inner vars into a reversed list and handling them just like vars in norm bindings.
2. Then perform a global re-sorting on all vars.
3. After that, the inner vars get frozen and dependent bounds are refreshed.

Author: N5N3