Replace ambiguous 'Recovering' state in MemLog, where we don't know which disk we'll end up with after recovery, with the unambiguous 'Rollback' state, where we know we'll roll back to the old one.
Replace ambiguous 'Recovering' state in MemLog, where we don't know
which disk we'll end up with after recovery, with the unambiguous
'Rollback' state, where we know we'll roll back to the old one.

Reuse MLog.Recovering state to instead represent the log at any point
during recovery.  It can be either:
- Synced: log is already okay, so recovery will not perform any writes
- Rollback: recovery will write a new header to roll back to the old
  disk
- Recovering: recovery has written a new header but hasn't synced it yet

All proofs in MemLog.v pass.

mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl