Increasing view change timeouts

[paberr]

Both PBFT and Albatross linearly increase the timeout for view changes after a view change.
Our code does not reflect that at the moment and uses a constant timeout instead.

First, to avoid starting a view change too soon, a replica that multicasts a view-change message for view v+1 waits for 2f+1 view-change messages for view v+1 and then starts its timer to expire after some time T. If the timer expires before it receives a valid new-view message for v+1 or before it executes a request in the new view that it had not executed previously, it starts the view change for view v+2 but this time it will wait 2T before starting a view change for view v+3.
see PBFT paper

We should adapt our code and increase the timeouts. In our Albatross paper we reset the factor after each slot.

[paberr]

Also, there might be a race condition with timeouts right now as in #49.