tbtc - Signer collusion may bypass increaseRedemptionFee flow
DepositRedemption.increaseRedemptionFee is used by signers to approve a signable bitcoin transaction with a higher fee, in case the network is congested and miners are not approving the lower-fee transaction.\\nFee increases can be performed every 4 hours:\\n```\\nrequire(block.timestamp >= \\_d.withdrawalRequestTime + TBTCConstants.getIncreaseFeeTimer(), "Fee increase not yet permitted");\\n```\\n\\nIn addition, each increase must increment the fee by exactly the initial proposed fee:\\n```\\n// Check that we're incrementing the fee by exactly the redeemer's initial fee\\nuint256 \\_previousOutputValue = DepositUtils.bytes8LEToUint(\\_previousOutputValueBytes);\\n\\_newOutputValue = DepositUtils.bytes8LEToUint(\\_newOutputValueBytes);\\nrequire(\\_previousOutputValue.sub(\\_newOutputValue) == \\_d.initialRedemptionFee, "Not an allowed fee step");\\n```\\n\\nOutside of these two restrictions, there is no limit to the number of times `increaseRedemptionFee` can be called. Over a 20-hour period, for example, `increaseRedemptionFee` could be called 5 times, increasing the fee to `initialRedemptionFee * 5`.\\nRather than calling `increaseRedemptionFee` 5 times over 20 hours, colluding signers may immediately create and sign a transaction with a fee of `initialRedemptionFee * 5`, wait for it to be mined, then submit it to `provideRedemptionProof`. Because `provideRedemptionProof` does not check that a transaction signature signs an approved digest, interested parties would need to monitor the bitcoin blockchain, notice the spend, and provide an ECDSA fraud proof before `provideRedemptionProof` is called.
Resolution\\nIssue addressed in keep-network/tbtc#522\\nTrack the latest approved fee, and ensure the transaction in `provideRedemptionProof` does not include a higher fee.
```\\nrequire(block.timestamp >= \\_d.withdrawalRequestTime + TBTCConstants.getIncreaseFeeTimer(), "Fee increase not yet permitted");\\n```\\n