Proof closures

[Chris-Hawblitzel]

Verus already supports exec-mode closures (Fn, FnMut, FnOnce) and spec-mode closures (spec_fn), so it makes sense to also support proof-mode closures. Since Verus treats proof-mode functions very similarly to exec-mode functions, I would expect that proof-mode closures would be very similar to exec-mode closures.

As far as I know, this feature is currently missing simply because nobody has gotten around to implementing it yet. Currently, the workaround is to use a trait instead.

[tjhance]

This would be useful implementing a verified Rc with T as covariant instead of invariant.