Update identity doc - ensure consistency of adds/removes

[richardhuaaa]

Incorporating feedback from @neekolas, my summary of his ideas:

The most important thing about processing commits to add/remove members is consistency. When some members apply a commit and others reject it, the group state gets mangled.

The validation code must not rely on network requests to verify an added installation was not revoked - as this leaves open the door to race conditions where different group members get different results immediately after a revocation.

Let's allow revoked installations to be added, but group members should periodically check for revoked installations in the group, and publish a commit to remove them that all group members will apply consistently (this logic is already in the doc).

We should also be able to attach a revocation proof to remove commits so that members can validate removals without going to the network, in the same way that a credential is presented in add commits, so that members can validate adds without going to the network.

To shorten the time window after a revocation gets committed to every group, the installation performing the revocation should go ahead and update all the groups that it knows of (this logic is already in the doc).

[richardhuaaa]

FYI @karthikbhargavan