Defend against bogus parameterization of join input paths.

 Defend against bogus parameterization of join input paths.
 
 An outer join cannot be formed using an input path that is parameterized
 by a value that is supposed to be nulled by the outer join.  This is
 obviously nonsensical, and it could lead to a bad plan being selected;
 although currently it seems that we'll hit various sanity-check
 assertions first.
 
 I think that such cases were formerly prevented by the delay_upper_joins
 mechanism, but now that that's gone we need an explicit check.
 
 (Perhaps we should avoid generating baserel paths that could
 lead to this situation in the first place; but it seems like
 having a defense at the join level would be a good idea anyway.)
 
 Richard Guo and Tom Lane, per report from Jaime Casanova
 
 Discussion: https://postgr.es/m/CAJKUy5g2uZRrUDZJ8p-=giwcSHVUn0c9nmdxPSY0jF0Ov8VoEA@mail.gmail.com