Do not write ledger snapshot without copying blocks to imm DB

[edsko]

At the moment there are two processes happening in the node that are unaware of each other:

1. There is a thread moving blocks from the vol DB to the imm DB.
2. There is a thread taking period on-disk snapshots of the ledger DB.

The problem is that if the latter thread takes a snapshot, it might consider a block to be immutable (and hence use it for the snapshot) which hasn't yet been copied into the imm DB by the former thread. When this happens, on start up the node will be unable to use this ledger snapshot and will have to default to an older one (#1454).

The problem is exacerbated by the fact that the node now takes a ledger snapshot on shutdown, without also doing a final volatile to immutable DB copy. It's therefore not all that unlikely to happen. What I think needs to happen is

1. Only take a ledger DB snapshot after copying blocks, making sure that there aren't any race conditions (in other words, decide which ledger snapshot to take, then copy to imm DB, then write the snapshot).
2. Don't take the final snapshot on node shutdown, and instead adjust the snapshot policy (Revise ledger DB disk snapshot taking policy #1264).