remove resolverID, consolidate kernel promise table into one identifier

[warner]

The syscall.createPromise() call currently returns two separate identifiers, a promiseID and a resolverID. Both are mapped through per-vat tables when the kernel delivers them into a vat, which we use to keep track of which vats are allowed access to which promises and resolvers. The kernel-side identifier is the same for each.

We think we can simplify things by only tracking a single value. This will be named promiseID on the kernel side, and importPromiseID on the vat side (since all promises are kernel promises, so any promise-related slots that the vat knows about will be imports from the kernel).

The kernel promise table tracks a "decider vatid" for each promise. We'll use this to authorize syscall.fulfillToXYZ, which will now accept an importPromiseID instead of a resolverID.

This will parallel a change in #162, where promises can be imported/exported between machines just like presences, and are not kept in separate tables.

[warner]

in the old repo. this was SwingSet issue 34