Use exception transitions only for critical errors

[treiher]

Exception transitions in protocol sessions should be only used for critical errors (e.g., out of memory). As interim solution exception transitions are also used in the following cases:

• Access to invalid element in sequence in list comprehension (I1 in Initial support of protocol sessions in SPARK #292 (comment))
• Access to invalid message field (I2 in Initial support of protocol sessions in SPARK #292 (comment))
• Access to empty sequence or invalid element using 'Head in assignment (Get matching element from sequence #527 (comment))
• Write invalid message to channel
• Use of 'Opaque on invalid message
• Invalid conversion of message (invalid refinement conditions)
• Creation of invalid message using message aggregate

[treiher]

We decided in #691 to use exceptions for all kind of errors.