SMTChecker: Contract invariants support

## Abstract
Currently the SMTChecker does not reason about contract global invariants.

```
contract C
{
uint a;
function f1() public { a = 1; }
function f2() public { a = 2; }
function f1(uint x) public
require(x < 10);
a = x;
}
}
```
In the example above, `a >= 0 && a < 10` is an invariant that might be useful to prove properties of other functions in the contract.

## Specification
Ideally we'd have a way to provide global invariants such that, for each invariant `I`:
* `assert(I)` is added in the end of the constructor
* `require(I)` is added in the beginning of every non-view function
* `assert(I)` is added in the end of every non-view function

If the SMTChecker proves all assertions, the invariant is inductive and safe.

Previous example updated with new suggested syntax:
```
contract C
{
uint a;
invariant { a >= 0 && a < 10 }
function f1() public { a = 1; }
function f2() public { a = 2; }
function f1(uint x) public
require(x < 10);
a = x;
}
}
```

The issue names the SMTChecker and proposes an `invariant` syntax, but no files or tests. Start by locating the SMTChecker entry point and the handling of contract-level syntax, then trace how constructor and non-view function assertions are represented. Done means the specified invariant checks are supported and inductive invariants can be proved as described.

Written by the indexing model from the issue text.