Allow a HO type to specify that the value will be called at least once or exactly once

[pschachte]

...and then permit procedure calls with outputs to be passed as such a HO value using the pass by reference technology added as part of the TCMC project. Since it is declared to definitely be called, the mode checker can be assured that the outputs will definitely be assigned by the higher order call. That will extend what can be done in library procs. For example, if the call1 modifier signifies that a HO value will definitely be called exactly once, we could define:

def trust(tst:{call1,test}()) {
    tst | error("Trusted procedure failed")
}

Then one could write a statement like:

    trust ?h = head(lst)

to bind h to the head of lst, throwing an error if lst is empty. This would be a nice answer to issue #368.