Remove the beneficiary from "self destruct"

[Stebalien]

Currently, the self_destruct syscall transfers funds to some designated beneficiary before deleting the actor. However:

1. Unlike send, if the target address is an account, the account won't automatically be created.
2. If we ever decide to run code on method 0, or allow actors to reject method 0, this will interact poorly with self_destruct (could lead to re-entrency into a "zombie" actor).

Proposal

Remove the beneficiary from self_destruct. Instead, passing a flag indicating if the remaining funds should be burnt or if the operation should fail if there are any remaining funds.

Alternatives

• Always burn the remaining funds on self_destruct.
• Always fail if there are remaining funds. As @anorth notes below, this may not always be possible.

Draft: #815

[anorth]

I'm down with the simplicity of burning. I'm not sure rejecting can always work. E.g. an entry point actor that needs to pay its own gas? It'll probably have some refund amount that needs to be burnt, at least.

We could change the parameter to be a boolean whether to burn funds or fail if non-zero balance.