Update Proposal #247 based on discussion and community review.

The following changes were made:

* Randomize second and third guard layers.

* Fold in my comments about using disjoint sets ("buckets") for the
  third level guard.

* Make the paremeter discussion subsection its own section, and include tables
  with far more detail for the Sybil success rates.

* Changed the default parameters based on these tables, and based on my own
  intuition about Tor's performance properties.

* Move the load balancing, torrc, and other performance considerations to
  their own section (Section 5).

* Move "3.2. Distinguishing new HS circuits from normal HS circuits" to
  section 4.1.

* Fold in some of "3.3. Circuit nodes can now be linked to specific hidden
  services" into 4.1. Some of it I just removed, though, because I did not find
  it credible.

* Added Roger's concerns about guard linkability to Section 4.2.

* Added a denial of service subsection to Section 4.3.

* Try to make a coherent threat model and specify its assumptions

* Put the rotation period in a separate subsection from the number of guards

* Switch to using min(X,X) and max(X,X) for the distribution for the
  second and third layer guard lifespans, respectively. Add a subsection
  describing this distribution (3.2.3)

* Include python functions for the min and max probability distributions.

* Mention that third nodes can probe to see if they are one of the current
  RPs.

* Provide CDF for rotation functions for Sybil runtime expecations.

* Add s7r's DoS points.

* Add notes from Thursday dev meeting discussion.

* Address Aaron's mailinglist comments (except for the CDF).

* Add discussion items from the dev meeting.