Vanguards questions

1. How do we choose the lifetime of an L2 vanguard? vanguard-spec says it should be picked from a uniform distribution:

   We set MIN_SECOND_GUARD_LIFETIME to 30 days, and MAX_SECOND_GUARD_LIFETIME to
   60 days inclusive, for an average rotation rate of 45 days, using a uniform 
   distribution. This range was chosen to average out to half of the Guard
   rotation period; there is no strong motivation for it otherwise, other than to
   be long. In fact, it could be set as long as the Guard rotation, and longer
   periods MAY be provided as a configuration parameter.

   but the code uses the max(X, X) distribution

     # Adds a new layer2 guard
     def add_new_layer2(self, generator, excluded):
       guard = next(generator)
       while guard.fingerprint in map(lambda g: g.idhex, self.layer2) or \
         excluded.router_is_excluded(guard):
         guard = next(generator)
   
       now = time.time()
       expires = now + max(random.uniform(MIN_LAYER2_LIFETIME_HOURS*_SEC_PER_HOUR,
                                          MAX_LAYER2_LIFETIME_HOURS*_SEC_PER_HOUR),
                           random.uniform(MIN_LAYER2_LIFETIME_HOURS*_SEC_PER_HOUR,
                                          MAX_LAYER2_LIFETIME_HOURS*_SEC_PER_HOUR))
       self.layer2.append(GuardNode(guard.fingerprint, now, expires))
       plog("INFO", "New layer2 guard: "+guard.fingerprint)

   Do we need to update vanguards-spec? Or is it the code that's wrong?

2. If the min/max lifetime ranges change (e.g. the user sets new values for the vanguard params in the config), do we need to retroactively apply the new lifetime requirements to the existing vanguards, or do the changes only apply to the vanguards selected after the change was made? FWIW, I think it should be the latter (the alternative would be, I think, to extend the lifetime of any vanguard that has a lifetime < new_min_lifetime, and to discard any vanguards that have a lifetime > new_max_lifetime... but there are probably multiple other ways of handling this, and I don't think any of them are sensible, so the answer here is probably to not retroactively apply these changes).

cc @mikeperry @nickm