typeintersect: fix potential free TypeVar caused by chained inner v…

…ar. (#53675)

Noticed when working on 02f27c2. The
substitution and re-sorting of inner vars are incomplete on master. This
commit re-organized the code by:
1. Flatten the inner vars into a reversed list and handling them just
like vars in norm bindings.
2. Then perform a global re-sorting on all vars.
3. After that, the inner vars get frozen and dependent bounds are
refreshed.

(cherry picked from commit 3d34f11)