feat(nns): Define update_canister_settings proposal type without execution

[jasonz-dfinity]

Why

Support a new proposal type to call ic0.update_settings for a canister controlled by NNS Root. This can be used to update memory_allocation, controllers, log_visibility, etc.

What

• Define such proposals
• Validation for the proposal type
• Disabling on the mainnet, so such proposals cannot be created until downstream is ready
• A state machine test to make sure proposals can be created (although we expect it to fail to execute)

Caveats

Due to how types in the NNS Governance is structured (proto -> rs -> candid), we are unable to create candid::Nat fields in a way that's easy to use by clients (protobuf doesn't have integer fields larger than uint64). For this reason, we do not support reserved_cycles_limit for now, since it is measured in # of cycles and has a range of u128. In the near future, we should be able to decouple the API types from the internal types, so that the API type can be nat, while the storage can be message Cycles { bytes raw_bytes = 1 }.