Subtree proofs, landmarks, and signatureless certificates - #96

Later, we'll use the same subroutine to generate both types of proofs, so it's useful to merge them into a single type.

This commit does not add any new functionality, but does some
refactoring like adjusting functions and APIs.

* Rename 'check_{inclusion,consistency}' functions to
  'verify_{inclusion,consistency}' for closer alignment to the spec.
* Rename function parameters for consistency (e.g., use 'n' for larger
  tree, 'm' for smaller tree, 'leaf_index' for leaf index)
* Add '_recursion' suffix to '{inclusion,consistency}_proof[_indexes]'
  functions and make them private (these will be replaced in a later
  commit). Rename 'prove_{inclusion,consistency}' to
  '{inclusion,consistency}_proof' for closer alignment with naming in
  spec, and add corresponding '*_indexes' functions that do bounds
  checks for safe public consumption.
* Add ProofError type to help distinguish between proof errors and
  server errors.
* Move TlogError enum to the top of the source file.

* Add Subtree struct to represent a valid subtree. (More functionality
  will be added later.)
* Add support for subtree inclusion and consistency proof verification.
* Replace recursive proof verification functions with ones aligned with
  the specifications.

* Add _internal suffix to subtree_hash and subtree_indexes functions.
  These will get removed later.
* Add subtree_hash_indexes, subtree_hash, and tree_hash_indexes
  functions with better API for public consumption.

SUBTREE_SUBPROOF generalizes the logic to compute inclusion and
consistency proofs, so we can use the `Subtree::subproof` function to
compute all of the various proof types.

* Add support for subtree consistency proofs.
* Deduplicate subtree recursion logic with 'walk_subtree' helper.
* Deduplicate merkle tree hash logic with 'walk_hash' helper.
* Remove all of the _internal/_recursion helper functions as those have
  been replaced.

* Add subtree inclusion and consistency proof support in log_ops.
* Update prove_inclusion and prove_consistency to verify the computed
  proofs, fetching additional tiles from object storage as needed.

The subtree inclusion proofs will be used for computing Merkle Tree
Certificate 'mtcProof' signatures, and the subtree consistency proofs
will be useful for constructing proofs that landmark subtrees are
consistent with some checkpoint.

* Add support for landmark checkpoints.
* Update /prove-inclusion to compute subtree inclusion proofs within
  landmark subtrees.
* Add checkpoint callback function that gets called every time
  sequencing completes with the new tree size and old and new
  timestamps. Importantly, if the callback fails, it does NOT count as a
  fatal sequencing error. This is used for updating the landmark
  sequence for the MTC sequencer.
* Rename validity_interval_seconds to max_certificate_lifetime_secs.

- Convert MTC /prove-inclusion endpoint to /get-certificate to return a
  signatureless certificate.
- Add read_leaf function to read and verify the needed tiles and then
  extract the data at a single leaf index. This is used to fetch a
  MerkleTreeCertificateLogEntry in order to construct a signatureless
  certificate.
- Add support for serializing a signatureless certificate and
  constructing the MTCProof from a subtree inclusion proof.

Use language from ietf-plants-wg/merkle-tree-certs#139 which aims to clarify some ambiguities.

We have to fetch additional tiles (to compute the leaf and landmark
subtree hashes) to validate subtree inclusion proofs right after we've
constructed the proof. Remove validation from the hot path as we have
bettter testing now and don't expect to create invalid proofs.

* Use debug_assert instead of assert in tlog library
* Improve documentation and variable naming for stored hash index
* Add link to spec for subtree definition