This change makes the commit index advancement in handleHeartbeat safe.
Previously, a follower would attempt to update the commit index to
whichever was sent in the MsgHeartbeat message. Out-of-bound indices
would crash the node.

It is always safe to advance a commit index if the follower's log is "in
sync" with the leader, i.e. when its log is guaranteed to be a prefix of
the leader's log. This becomes true when the first MsgApp append message
succeeds.

At the moment, the leader will never send a commit index that exceeds
the follower's log size. However, this may change in future. This change
is a defence-in-depth.

Signed-off-by: Pavel Kalinnikov <pavel@cockroachlabs.com>

This commit adds a test demonstrating the effect of delayed commit on a
follower node after a network hiccup between the leader and this
follower.

In the described scenario, after the moment of committing an entry on
the leader, it takes HeartbeatInterval + 3/2 * RTT until the follower
learns this entry is committed.

This is suboptimal, and could take HeartbeatInverval + 1/2 * RTT if the
leader didn't cut the commit index at Progress.Match before sending it
to the follower.

Signed-off-by: Pavel Kalinnikov <pavel@cockroachlabs.com>

TODO: describe why it is now safe

Signed-off-by: Pavel Kalinnikov <pavel@cockroachlabs.com>