HsDesc revision counters need to survive restarts

Remembered this requirement while writing a changelog: we'll need to make sure that our revision counters are montonically increasing for any single HsBlindId, even if Arti restarts during the time period where that ID is active.

One solution here is to persist the IDs to disk. A bad solution is to use the current time offset within the time period. A better solution (which C tor uses) is to use an order-preserving-encryption scheme to ensure that the revision counter increases deterministically every second, without actually leaking the view of current time.

See appendix F for more background here.

I can hack up the OPE scheme from C tor if we go that way.

cc @gabi-250