fix: make message signer nonce generation transactional

[dirkmc]

Fixes two problems with nonce generation:

• nonce generation was not transactional, so if Mpool.Push failed, there would be a gap between nonces
• there was no lock when generating a nonce, so two messages could end up with the same nonce

[vyzo]

when is the nonce incremented?

[magik6k]

(testing manually)

[magik6k]

(seems to work, with the right stuff in the datastore)

[Kubuxu]

I don't think this will resolve the issue:
If people are nonce-gaped, on a restart, we will ask Mpool for Nonce. Mpool will return a nonce before the gap, after we fill the gap, we will try to push messages where there is already a message, which will fail due to RBF not being triggered.

[vyzo]

they will have to manually clear the mpool with lotus mpool clear --local --really-do-it