[protocol,engine] Recovery address

[LayneHaber]

Channels should have the option to have a recoveryAddress. This address is what should be used in the channel.balances and transfer.balance arrays should the signer's private key get compromised. This address should be able to be set on channel setup.

There are some other considerations: (1) How would I change this address during my channel lifetime? (2) Should the recovery address be a channel- or transfer-based property? (3) How can we make sure both parties agree on what the other's recovery address is when generating updates?