proof_global: make it possible to call close_proof in a worker

Given that the proof state contains a callback (a terminator)
that is not sent (dropped by the ephemeron mechanism at marshall
time) de-referencing the ephemeron during this function makes it
impossible to call it in a worker.  Now the worker can call the
function and replace the terminator with a good one.
STM: module Pp is open
STM: fix processing of errors
STM: check with the kernel proof terms on the worker too

Before this commit the worker was sending back a proof term
as built by tactics.  The master receives the proof terms and
eventually (when one clicks on the gears in CoqIDE) check it
with the kernel.  This meant that errors like the ones produced
by the "fix" tactics were discovered very late.

Now a worker checks with its kernel the proof term before sending it
back.  The term is also checked by the master, eventually, but the
error is signaled early.