Immutable DB: Validate that blocks really are immutable

When the system clock is moved back, some blocks that we thought were immutable might turn out not to be. When the node detects that the clock moves back. it will die with an exception (#759). When we subsequently restart the node, we should do a validation pass. When the imm DB is validating all blocks, it should validate that all blocks there really are immutable, i.e., older than `k` (according to the wall clock).

Any blocks that are not immutable should just be considered as invalid, and deleted. The ChainDB spec says that we should move them to the volatile DB instead; this is a possibility, but strictly an optimization. This is such an unlikely event that requiring the node to get (at most) `k` new blocks from an upstream node would be no big deal at all.