Notifications System core

Following https://issues.cask.co/browse/CDAP-849 jira and design doc.
Build is running at https://builds.cask.co/browse/CDAP-DUT320-3.
I think it's different in this context, especially your policy is call `TxRetryPolicy`, implying retry only if something related to Transaction is wrong. An analogy is in `ExecutorService` that someone can specify a `RejectedExecutionHandler` to keep resubmitted the job if it cannot be submitted, but it won't resubmitted the job if the runnable throws exception when executing.

I copied the definition in the flowlet `Callback.failure` method:

```
   * This method will be called when processing of a given input failed. Failure could be triggered due to
   * exception thrown in the process method or a system error. The return value of this method
   * is used to determine what action to take about the failure input.
```

the callback is not just for transaction failure, but also for user failure as well to give user greater control based on the input (e.g. to skip malformed input). However, I think it's too complicated in the TxRunnable case, especially there is no input to skip as in the Flow case.