pgsql: Perform a lot more sanity checks when freezing tuples.

Perform a lot more sanity checks when freezing tuples.

The previous commit has shown that the sanity checks around freezing
aren't strong enough. Strengthening them seems especially important
because the existance of the bug has caused corruption that we don't
want to make even worse during future vacuum cycles.

The errors are emitted with ereport rather than elog, despite being
"should never happen" messages, so a proper error code is emitted. To
avoid superflous translations, mark messages as internal.

Author: Andres Freund and Alvaro Herrera
Reviewed-By: Alvaro Herrera, Michael Paquier
Discussion: https://postgr.es/m/20171102112019.33wb7g5wp4zpjelu@alap3.anarazel.de
Backpatch: 9.3-

Branch
------
REL9_4_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/ed8e1aff6acef475eb33e0212253df05cb2d4d20

Modified Files
--------------
src/backend/access/heap/heapam.c      | 122 +++++++++++++++++++++++++++++-----
src/backend/access/heap/rewriteheap.c |   5 +-
src/backend/commands/vacuumlazy.c     |  15 ++++-
src/include/access/heapam.h           |   5 +-
src/include/access/heapam_xlog.h      |   2 +
5 files changed, 126 insertions(+), 23 deletions(-)