tor-proto: Introduce CmdChecker, and use it to enforce correctness for our streams.

The role of CmdChecker is to verify that messages are arriving at the appropriate sequence on a stream, with respect to the other messages that have been received. Once the stream becomes half-closed, the CmdChecker is also in charge of consuming incoming messages on the stream and making sure that they are well-formed.

Fixes #769 (closed). Fixes #774 (closed).