Ensure we apply the necessary restrictions when building vanguard circuits

The following discussion from !2046 (merged) should be addressed:

• @nickm started a discussion:

  For both cases where you call select_vanguard, and for when you use relay_selector below in this function:

  Watch out: just because we aren't enforcing family restrictions, doesn't mean we have no restrictions at all. In particular, I think we we have to prevent the same Relay from appearing twice consecutively. (A relay won't let you extend a circuit to itself.)

  @mikeperry Is that right? And is the only restriction on vanguard-based paths?

  This has implications for the select_vanguard API; maybe it needs to take a RelayExclusion.