FileJournal: add committed_up_to to header

header_t::committed_up_to provides a lower bound for safetly committed
journal entries.  If read_entry fails prior to committed_up_to, we
know we have a corrupt jorunal entry.  Furthermore, if
journal_write_header_frequency is not 0, we will write out the
journal header once every journal_write_header_frequency
journal writes.

Signed-off-by: Samuel Just <sam.just@inktank.com>
FileJournal::wrap_read_bl: convert arguments to explicit in/out arguments

Signed-off-by: Samuel Just <sam.just@inktank.com>
FileJournal,Journal: detect some corrupt journal scenarios

When the checksum or footer are invalid, we will now try to
look at the next entry.  If we find a valid entry, it is likely
that the journal is corrupt.

Signed-off-by: Samuel Just <sam.just@inktank.com>
FileJournal: add testing methods to corrupt entries

Signed-off-by: Samuel Just <sam.just@inktank.com>
test_filejournal: add tests for footer, header, payload corruption

Signed-off-by: Samuel Just <sam.just@inktank.com>