Replace use of AppendEnv/RestoreEnv pairs with instances of
SaveRestoreEnvironment.  Simplify the signature of AppendEnv and use it
in place of similar loops elsewhere.  Move the RestoreEnv implementation
inside the SaveRestoreEnvironment destructor which is the only place
left that calls it.