implement shard retirement

[brenzi]

We need a way for governance to shut down a sidechain without waiting for all account holders to withdraw their funds. One possible use case is migrating to a different logic that may be controversial: in that case we would not want to force anyone to participate.
Another use case could be a panic mode: setting the shard in maintenance mode and retire it entirely because fixing might not even be possible or practical.

From a security & privacy perspective it should actually be fine if we simply unshield all L2 accounts to identical L1 accounts. The privacy lies in the transactions, not in the balances of accounts which have no linkability anywhere.

Open questions:

• what contidions must be met to retire a shard?
• edge cases: what if final dump extrinsics fail?
• in maintenance mode, no more blocks should be produced. how to implement idempotent retirement? How to make sure each account is only unshielded once?