[C#] Clarify and enforce BumpEpoch protection assumptions

[tli2]

Revise BumpEpoch to accommodate calling from both protected and unprotected contexts. Revise FasterLog completion logic to avoid epoch double-protect. From now on, users should assume that any trigger action associated with BumpEpoch will execute on a protected thread after it is safe. Caller thread of BumpEpoch can be either protected or unprotected.

fix #872