Type system guards on message creation

[fjarri]

Currently Session code needs to remember to

• get the list of message destinations from a new Round,
• create an echo broadcast
• create direct messages to the destinations from the above list.

This is error-prone. Can we make it stricter? For example, when finalize() returns the next round, it can instead return a structure with the echo broadcast (if any) and message destinations already present there. Also, instead of message destinations we may return "message factories", each of which can be consumed to generate a message.