Make HepProgram thread-safe

HepProgram uses mutable fields for its working state and is therefore not thread-safe. If two threads are planning queries simultaneously and are using the same HepProgram instances they might conflict with each other. I suspect that this happens several times in Calcite's standard set of rules.

This change would move the mutable state out of HepProgram, so that HepProgram is fully immutable and therefore thread-safe.

It would also modernize some of the internals; for instance, class HepInstruction.MatchLimit has a field int limit that could be made final and assigned in the constructor.