Create a safe interface for nested non-empty Map

There are two occurrences of this use case in Ledger: `MultiAsset` in `cardano-ledger-mary` and `VotingProcedures` in `cardano-ledger-conway`.

We need a new safe interface in `cardano-data` that provides a safe wrapper around a nested Map called `newtype SNMap ki ko v = Map ki (Map ko v)` (strict nested map), which does not export the constructor form public API and preserves these invariants:

* Inner Map cannot be empty
* Semigroup instance is also a Semigroup on the inner Map, but not on the elements. This is necessary to match semantics of the original Map (i.e. `Map.unionWith Map.union ...`)
* It must be strict in keys and elements alike. (this is a deviation from consistency with Map, but that is what we need)

It also must provide all the useful functions that we would normally expect from a regular Map. It doesn't have to be an exhaustive match of `containers`, just the most useful functions:

* `insert :: (Ord ki, Ord ko) => ki -> ko -> a -> Map ki ko a -> Map ki ko a`
* ....
* `fromList :: (Ord ki, Ord ko) => [(ki, ko, a)] -> Map ki ko a`

It must include property tests for all new functions in the interface.

Applying this new interface to `VotingProcedures` and `MultiAsset` will be done as a separate followup task: #3711

Start by inspecting the existing MultiAsset use in cardano-ledger-mary and VotingProcedures in cardano-ledger-conway, then review the cardano-data APIs. Define the safe nested-map interface around the stated non-empty and strictness invariants, including useful Map operations and property tests for each new function. Applying it to those two types is explicitly deferred to follow-up issue #3711.

Written by the indexing model from the issue text.