onchaind: don't assert() when htlc fulfilled twice.

In the normal (peer-to-peer) path, the HTLC state prevents us fulfilling
twice, but this goes out the window with onchain HTLCs.

The actual assert which caught it was lightningd/pay.c:70 (payment_succeeded)
in the test_htlc_in_timeout test, after the next commit.

So add an assert earlier (in fulfill_our_htlc_out) and check in the
one caller where it can be true.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

lightningd/peer_htlcs.c

@@ -651,6 +651,7 @@ out:
 static void fulfill_our_htlc_out(struct peer *peer, struct htlc_out *hout,
 				 const struct preimage *preimage)
 {
+	assert(!hout->preimage);
 	hout->preimage = tal_dup(hout, struct preimage, preimage);
 	htlc_out_check(hout, __func__);
 
@@ -700,7 +701,11 @@ void onchain_fulfilled_htlc(struct peer *peer, const struct preimage *preimage)
 		if (!structeq(&hout->payment_hash, &payment_hash))
 			continue;
 
-		fulfill_our_htlc_out(peer, hout, preimage);
+		/* We may have already fulfilled before going onchain, or
+		 * we can fulfill onchain multiple times. */
+		if (!hout->preimage)
+			fulfill_our_htlc_out(peer, hout, preimage);
+
 		/* We keep going: this is something of a leak, but onchain
 		 * we have no real way of distinguishing HTLCs anyway */
 	}