Require a threshold of exit nodes before believing we can build circuits

We should not allow circuits to get built unless we know descriptors for a sufficiently large fraction of exit nodes.

This should mitigate an attack proposed by wanoskarnet, wherein your bridges collude to only tell you about compromised exits. See also legacy/trac#5342 (moved).