Prove invariants with `ensures`

When it comes to ensuring global properties of the system, we can by induction prove global "accounting invariants" using the `ensures` clause and `requires` clauses. I imagine a procedure that goes as follows:

For each contract, we make a spec with completely abstracted calldata (so that we can explore every execution path, this relates to https://github.com/dapphub/k-dss/issues/16), include the relevant storage variables and assume the desired invariant in the `requires` clause, and claim that however the storage updates, the invariant will hold in the `ensures` clause. Together with a proof that the invariant holds at contract creation, this proves by induction that the invariants hold.

We haven't really utilized the `ensures` clause thus far, but this seems like an excellent opportunity to do so.

Start by reading the existing contract specifications and how `requires` and `ensures` clauses are currently used. Review the related abstract-calldata work in issue #16, then determine how each contract can express the relevant storage invariant and how the contract-creation proof establishes it. Done means the proposed induction-based invariant proofs are implemented and validated.

Written by the indexing model from the issue text.