This Serializer which is implemented
external to the IR node definition
uses a StringBuilder to achieve about a
1.7x performance improvement when serializing.

Eventually, all implementations of the
`serialize` methd should be replaced with
a call to `Serializer.serialize`.

However, for this PR we keep the old
code in place in order to allow for easy
regression testing with the benchmark JAR
like this:
> java -cp utils/bin/firrtl-benchmark.jar \
  firrtl.benchmark.hot.SerializationBenchmark \
  ~/benchmarks/medium.pb 2 5 test

Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

* Add testcase for empty message

* Add assume, assert, cover statements
* Assert submodule assumptions
* Add warning when removing verification statements
* Remove System Verilog behaviour emitter warning
* Add option to disable AssertSubmoduleAssumptions
* Document verification statements in the spec

The syntax for the new statements is

    assert(clk, cond, en, msg)
    assume(clk, cond, en, msg)
    cover(clk, cond, en, msg)

With assert as a representative example, the semantics is as follows:
`clk` is the clock, `cond` is the expression being asserted, `en` is the
enable signal (if `en` is low then the assert is not checked) and `msg`
is a string message intended to be reported as an error message by the
model checker if the assertion fails.

In the Verilog emitter, the new statements are handled by a new
`formals` map, which groups the statements by clock domain. All model
checking statements are then emitted within the context of an `ifdef
FORMAL` block, which allows model checking tools (like Symbiyosys) to
utilize the statements while keeping them out of synthesis flows.

Co-authored-by: Albert Magyar <albert.magyar@gmail.com>