feat: buy a member's shortfall with its top-up after an outage allowance is removed

[timwu20]

Stacked on #71, which lets a dedicated synchronizer's operator set an outage traffic allowance. This handles what happens once the operator removes it, split out of #71 in review.

A member that used the allowance is below zero once it's removed, and the sequencer refuses it until its purchases cover what it consumed.

• Shortfall with the top-up. When a member's remainder is below zero, the validator's top-up buys that shortfall together with the configured top-up in one purchase, and the funds check prices both: minWalletBalanceForTopup takes the extra traffic as a parameter. Before, it bought one top-up per minTopupInterval and left the member blocked for several intervals.
• Fallback. If the wallet doesn't cover both, it buys the top-up alone, which still pays the shortfall down one interval at a time. It warns when that leaves the member below zero, and logs at info when the top-up alone covers the shortfall.
• Not buying it twice. The member's traffic state only shows a purchase once the operator grants it. So the validator remembers, in memory, the traffic-state serial its last shortfall purchase was made at, and buys the top-up alone while that serial is unchanged. Any traffic update ends this, as does a restart, so a shortfall can occasionally be bought early; the traffic is kept.
• Budget. The budget goes first to purchases that leave their member able to submit, then to those fallbacks with what's left, so a fallback can't starve another synchronizer's top-up.
• Warnings. When even the top-up alone doesn't fit, the insufficient-funds warning names both amounts.

With no shortfall, the top-up behaves exactly as before. The shortfall bought isn't capped, so it's bounded by the allowance the operator set. The top-up docs (traffic_topups.rst) and ValidatorAppConfig comments describe it.

Tests.

• SyncOperatorTrafficIntegrationTest continues feat: let the sync operator set an outage traffic allowance #71's outage flow past the removal: bob is refused, then one top-up buys exactly his shortfall (27.5 KB) together with his top-up (12 KB, derived from his config), and he transacts again. It checks the shortfall is larger than the top-up, and that bob's participant sees the same remainder as the sequencer.
• The test environment is DevNet, where the wallet doesn't bound purchases, so the fallback and the two-pass budget are covered by unit tests only, as is the decision whether to hold the shortfall.
• Unit tests for the shortfall, the hold, the two-pass budget allocation and the pricing.

Closes ChainSafe/canton-extending-mainnet#129, together with #71.