Limit Miner.ChangeWorkerAddress to avoid cron event queue load

[wadealexc]

Currently, this method may be repeatedly invoked by a Miner to append cron events to the Power actor's CronEventQueue.

Consider restricting this method to Miners with some minimum power requirement.

Related: #802

[anorth]

Fair enough, we should do something here.

Since we record an activation epoch with each change request, we could rate limit this instead, requiring any existing change request to have no more than N epochs until activation before allowing it to be replaced?

[ZenGround0]

SGTM. One thing to watch out for is shifting collateral requirments. It seems less likely now, but if we reintroduce fixed collateral for miner creation (i.e. as part of potential upcoming consensus fault security changes) then even a zero power miner actor could have significant value and for great UX we should allow owners to swap out worker keys in that case.