Support operations with multiple suspension points

[alefedor]

See #121 for an example of Lincheck failing in the case of multiple suspension points per operation

[btwilk]

This restricts modular testing to using only a single submodule.

[ndkoval]

Supporting multiple suspensions is vital for #167

[ndkoval]

Please have a look at #143 for preliminary support in the runner. Let's support multiple suspensions ONLY in the runner, printing an error if multiple suspensions occur in the verification phase.

[btwilk]

Can you clarify whether support in only the runner would resolve #121 ?

[ndkoval]

@btwilk yes

[ndkoval]

Note: with allowing multiple suspensions only in the running phase, we need to check that at most one suspension occurs in the verification phase.