signatures: check a bounded number of invalid received signatures

A sync message carries up to 65536 signatures (MAX_PER_MESSAGE), and the
receiver checks, under the document's write lock, each one of a held
change that would vouch for more of its actor's changes than the one
before: about 30 µs each. A member sending that many signatures that
don't verify cost the receiver about two seconds of writes per message.

Signatures::offer and vouch_batch now stop checking after 64 found
invalid (MAX_INVALID) and drop the rest unchecked, with a warning. A node
forwards only signatures it verified, so an honest peer sends none.
offer counts those a message brings apart from those that waited for
their changes, which came from any peer. Signatures::vouch says which it
found (Vouched): more vouched for, nothing more, or invalid.

0 files changed, 0 insertions, 0 deletions