EncryptedTally has no specified state to catch errors

[JohnLCaron]

An EncryptedTally has accumulated encoded counts with no internal state to catch errors.

Ive added in EncryptedTally:

1. a list of castBallotIds so you can detect if ballot tries to get added twice
2. the electionId, so you dont add a ballot to the wrong tally
3. optional ballot_count in the contest should help diagnose miscounts.

Anticipating the possibility of a tree of tallies that need to be added together
4. In TallyResult, a list of tally ids that were summed to get the EncryptedTally.

Noe of these are part of the EG specification. They may in some case compromise privacy. So they need to be thought about for a specific use cases.

[JohnLCaron]

TODO: Make countNumberOfBallots nullable so its not serialized if its not enabled.