Self healing open

[cjen1-msft]

This PR is the reification of: #7003

The idea is that if a service has fully crashed, it should be able to heal itself so long as it isn't too damaged.
Specifically, the restarting nodes should gossip the knowledge they have locally to try and elect the replica with the best local state.

The result is that after the self-healing-open one replica is chosen to recover and open, while all others restart to then join it.

The protocol can be roughly surmised as:

• Start up.
• Gossip your state (claimed length of ledger) and authenticate other replicas attestation and identities.
• Once you have heard from everyone you expect to hear from, vote for the node with the longest ledger (ties broken by identity).
• If you receive votes from a majority of your expected cluster, transition_to_open and broadcast IAmOpen to the other nodes.
• If you receive IAmOpen from a trusted node, restart and join it.

This still requires the submission of ledger recovery shares, however if local sealing is available those can be used instead.