valset: Never allow empty validator set

[ethanfrey]

This happened in a bug that crashed testnet 3. It may also happen on a testnet if everyone unstakes at once.

Let's add a quick sanity check, so if calculate_validators returns an empty set, we do not apply it (apply no diff). It should make some log message so we realise this case rather than just ignore it.

Open to thoughts on how to best handle it (some backup validator to use?) but we should ensure this state never occurs.

[hashedone]

Maybe just leave the old validator set in such case? And emit some diagnostic event about such case - we could have tool listening to such events to react in the case as it is something to react on. I know it may prolong the age of slashed validators, and ones which didn't pay for being them, but it still seems like less dangerous than empty validators set.