IF: Implement finalizer policy change at appropriate time

[greg7mdp]

When a block containing a finalizer_set change proposal becomes final, we shouldn't switch to the new finalizer_set immediately, as different finalizers may receive the message at different time, and therefore not use the same finalizer_set.

So when a block containing a finalizer_set change proposal becomes final, the new finalizer_set should be pending until the next new_view message, allowing all finalizers to use the same finalizer_set in the new view.

[arhag]

Actually I think this should be delayed until another QC before switching finalizer sets. I think this is essential to maintain safety of the protocol despite finalizer set transitions.

EDIT: Actually waiting for another QC is not generally sufficient. We may need to wait for another 3-chain before it is safe to switch over to the new finality set.

[arhag]

We have an implementation of finalizer policy changes that works okay even if it is a little conservative. The proper algorithm can come later and is tracked in a new issue: AntelopeIO/spring#89.