Watermarks and watermark rules

[rphmeier]

Introduce a new field to CandidateReceipt which is a BlockNumber. Setting the watermark to X indicates that all messages sent at or before X to the parachain the candidate is for have been processed before or within that block.

Since CandidateReceipts are always associated with a specific relay chain block hash, the numbers can easily be converted to hashes.

The watermark must be set as high as possible based on the messages that have been processed within the chain. As a result, every parachain candidate must have its watermark at least as high as its parent.

The relay chain tracks the latest watermarks of included parachain candidates.

The open question is what other rules we should institute for setting watermarks. If we are currently at block Y and the watermark for parachain P is at X, we might require that no parachain candidate can be included where the watermark is less than X + max(min(Y - X, K), (Y - X)/2) where K is some constant like 5 or 10. This kind of logarithmic approach means that a P which falls far behind in routing will catch up in ~log2(Y - X) blocks, assuming that candidates for P are regularly included.

[rphmeier]

Also, watermarks should not be allowed to surpass any pending code changes. cc @burdges @AlistairStewart

[rphmeier]

done