Construct quorum certificate incrementally (BFT-386)

[moshababo]

Constructing quorum certificates from a batch of signed messages creates redundant error checks which are hard to reason about.

Since this operation's failure is unacceptable and can only occur as a result of a bug, it is preferred to construct incrementally upon receiving each message.

However, this refactoring ended up with no error checks during the incremental construction, delegating responsibility to the message processing.

Consequently, this change can be viewed merely as code cleanup which removes redundant error checks, and the incremental steps as a safer way to do that.

Notes

• Batch-mode functions throughout the stack are no longer used in non-test code, and were moved to testonly. They can be removed altogether if tests will construct incrementally as well.
  • PrepareQC::from
  • CommitQC::from (also seemed to had a duplicated error check which was removed)
  • validator::AggregateSignature::aggregate
  • bn254::AggregateSignature::aggregate

[brunoffranca]

Overall, looks good. A small nit, I don't see the need to have a separate Builder type. A QC is still a QC, even if it doesn't have enough signers.

[moshababo]

A small nit, I don't see the need to have a separate Builder type. A QC is still a QC, even if it doesn't have enough signers.

Agree, I added the higher-level structs due to having additional fields. But I ended up removing all of them, delegating responsibility for correctness to the caller.