Keeping track of ttls for pollard

[kcalvinalvin]

Problem

A bridgenode is easily able to crash CSNs with out of memory errors currently as Pollard has no way of tracking:

1: If the leaf was indeed removed within the Lookahead window.
2: Which peer gave the leaf that wasn't removed within the Lookahead window (if the ttl was wrong).

Suggestion

Introduce ttlMap field in Pollard like so:

       type ttlPeer struct {
               peer uint16
               ttl int32
       }
       // ttlMap is mapping of [height] to [leafHash:ttlPeer] that is used to
       // make sure the ttl values given by the peer are correct. Because a malicious
       // peer may give wrong ttls, we keep track of the peer that gave the ttl
       // for a leaf.
       //
       // Each [leafHash:ttlPeer] pair should be removed at the [height] it is marked at.
       // If the [leafHash:ttlPeer] at that height isn't removed, the peer gave a wrong
       // ttl.
       ttlMap map[int64]map[Hash]ttlPeer

Each Leaf that's remembered should be inserted into this map. The [height], key is where the leaf should be removed. After IngestBatchProof() is complete, Pollard should remove all [leafHash:peerNum] that correspond to a leaf being deleted. If there are any leftover [leafHash:peerNum] after this step, these leaves should be forgotten anyways and the peerNum should be passed to the caller so that CSN can ban the peer.

Downsides to the suggestion

This method is ok but there's no way of telling if the leftover [leafHash:peerNum] is remembered for too long or not enough. So there is a downside in that a leaf that could be remembered isn't remembered but it should be ok since we ban the peer immediately.

Another downside is that when we find a malicious peer, we can't remove all the [leafHash:peerNum] keypairs that were from this peer since the peerNum isn't addressable. So a peer that gave a bunch of wrong information in the past may have an effect for a while even after the peer is banned.