Since b78211ca6, OpIds have been silently truncated to 2**32. This
causes corruption in the case the op id overflows.
This change converts the silent error to a panic, and guards against the
panic on the codepath found by the fuzzer.
* Fix doubly-reported ops in load of change chunks
Since c3c04128f5, observers have been
called twice when calling Automerge::load() with change chunks.
* Better handle change chunks with missing deps
Before this change Automerge::load would panic if you passed a change
chunk that was missing a dependency, or multiple change chunks not in
strict dependency order. After this change these cases will error
instead.
