Validate order amounts

[fedgiac]

After this PR, a user intent is fully respected in a settlement: fill-or-kill orders become actually fill-or-kill; the maximum sell/buy amount is respected. And accounting is done so that partial fills add up across settlements.
This concludes all checks needed to execute a basic settlement. This PR should be reviewed with the idea in mind that all protections for a user intent are in place. Any way to exploit user intents by solvers would be a security issue at this point for reviewing purposes.

Notably, DESIGN.md changes a bit: full-on snapshots aren't needed anymore, the cumulative amounts bought/sold are enough for everything we need to do on-chain. (@tilacog: the partial amount traded so far is only present in the PDA, should we emit something here for the back-end? In principle it can be derived from the past settlements though).
This allows us to simplify the finalize instruction: we don't need any further checks in FinalizeSettle, we're doing everything we need in BeginSettle already.

The checks

For each order, after its pulls execute, process_order computes amount_in (total pulled) and hands it, with amount_out (the paired push), to a pure check_order_amounts helper that enforces:

• amount_in <= sell_amount for sell orders.
• amount_out <= buy_amount for buy orders.
• Fill-or-kill: a non-partially_fillable order's exact side must be filled completely (sell: amount_in == sell_amount; buy: amount_out == buy_amount).
• u64 overflow checks.

Notably, thanks to the way the math is structured, there's no place where we need to worry about rounding issues anywhere in the programs.

Tests

Added integration tests to settle_limit_prices.rs.
As before, some errors (notably overflows) are only checked in unit tests.