Try to fix `_SubstitutedTypeParameters`

It really looks like `_SubstitutedTypeParameters` factory
constructor assumes its `substitution` argument doesn't
include any of `elements` neither as a key, nor anywhere
it the result types. Since if it does contains a key from
`elements` that part of `substitution` will be lost, overriden by
`...substitution2.map` part of `Substitution.fromMap` call.
And if it has `elements` mentioned anywhere in values of the
`substitution` map, those won't be renamed.

But sometimes `_SubstitutedTypeParameters._SubstitutedTypeParameters`
is called with a `subtitution` that includes some of `elements`.
For example, that's what happens in both added tests.

I assume it never breaks, because the part of `substitution`
that acts on `elements` is trivial: just renaming a type
variable to a fresh name. And since `_SubstitutedTypeParameters`
just gets yet another fresh name for it, that works.

One small problem arises though if a type variable renamed by
`substitution` has a bound that references the type variable itself
(like `T extends Foo<T>`). In that case bound gets substituted with the
`substitution` first, so `substitution2` doesn't work on it anymore.
So we end up with an element `T0 extends Foo<T1>`, where `T0` and
`T1` and two different fresh names for `T`.

This commit changes the order of substitutions when handling bounds,
such that the part of `substitution` that substitutes `elements` is
effectively ignored. That agrees with the existing behavior of
rewriting this part of `substitution` in the result, so it shouldn't
make things worse.

Change-Id: I8f68c4342aad0c8f59f7c01a6cfac074946529ef
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/312401
Reviewed-by: Konstantin Shcheglov <scheglov@google.com>
Commit-Queue: Ilya Yanok <yanok@google.com>