add recordIndex to container payload to mitigate reordering attacks

Container diffs are authenticated-encrypted independently and stored in transaction records. In correct operation, a client that is writing to a container must demonstrate knowledge of the last transaction id applied by the server; in that case, records will not be reordered. However, since there is no end-to-end authentication over the ordering or grouping of diffs, a server can freely reorder or selectively drop diffs without detection.

Here we add a `recordIndex` attribute to container record payloads and verify these values when loading containers. Note that this is a backwards-incompatible change, and existing containers will be unusable.