Add checks that prefix counts are consistent across multiple VDAF executions

[schoppmp]

Fixes #316

[cjpatton]

This looks to be on the right track, modulo our conversation today about compatibility with DP. I think the only thing that would change is enforcing count consistency, in which case we would take some version of this PR no matter what the outcome is.

I'd suggest implementing in the reference code so that we can unit test is_valid() and make sure the changes to the rest of the construction still pass our current tests. If you like you can leave out the count checks.

[schoppmp]

Following the discussion in this doc, it seems clear that differential privacy is required to implement heavy hitters privately. For now, this PR only ensures that the tree is traversed correctly (i.e., not on arbitrary leaves; see mitigation 1 here).

The details of how to add differential privacy to a heavy hitters protocol based on Poplar should be specified in the higher-level protocol, as VDAF doesn't have any syntax for DP (like privacy parameters). There are also different ways to implement DP here, so this is not something we want to restrict in VDAF.

[cjpatton]

LGTM, though I think we could increase test coverage a bit.