1/3 disabling limit in substrate

[eskimor]

If we ever end up disabling more than a third of the validators, we know that something is off as our byzantine assumptions have been violated. If this ever happens, the right thing to do is to cap disabled validators at 1/3 of the nodes - re-enabling the least slashed nodes again, so we never go above 1/3.

With this we ensure liveness even if things go severely wrong.

[ordian]

If this ever happens, the right thing to do is to cap disabled validators at 1/3 of the nodes - re-enabling the least slashed nodes again, so we never go above 1/3.

Ideally, not re-enabling per session would simplify things: we can assume that the latest block in the session is the aggregated state of disabled validators in that session - this will be useful for past session disputes. #1841 for statement-distribution already uses this assumption.

[Overkillus]

Dispute sync: make a runtime parameter for it disabling limit, default to byzantine