Enforce additional best practices for iterators

[shaspitz]

Problem

According to communicated sdk best practices, we're using iterators in two ways that are potentially dangerous.

Closing criteria

we need to enforce two practices throughout the ICS repo:

1. Only make operations to short-lived local variables inside an iterator callback (never write to a store queue in iterator as example, even if seemingly "out of domain")
2. Never use embedded iterators

Problem details

Iterator contract: https://github.com/cosmos/cosmos-sdk/blob/47f46643affd7ec7978329c42bac47275ac7e1cc/store/types/store.go#L224

[shaspitz]

Idea from @jtremback, to accomplish 1 we no longer expose iteration methods, and only define "GetAll" methods that return lists of records. Any writes to the store can happen with logic based on the returned list