DiskQueue files can grow infinitely

As reported [on the forums](https://forums.foundationdb.org/t/extremely-large-logqueue-file/1049/), there exists some rare bug in which upon recovery, a transaction log can manage to never swap disk queue files, and only append to one file infinitely.

Simulation doesn't have any strong checks that would prevent this sort of behavior, so some should be added to see if simulation manages to reproduce less exaggerated versions of this problem.

Start with the transaction log's disk queue recovery and file-swapping paths, then inspect the simulation checks around them. Try to reproduce a recovery case where one disk queue file only grows; done means simulation detects or prevents unbounded appending and includes a check for the behavior.

Written by the indexing model from the issue text.