A formal proof of Goodstein's theorem