Change "done" mechanism to be tolerant to Single Event Upsets.

[Lynx005F]

This changes how the true_done flag is calculated:

• If the internal is_working register experiences a single event upset, then currently true_done might never be set and as such the FSM can stall the accelerator. At the same time true_done can not just be done from the input since that might be set on reset.
  To solve this, make true_done assert on the rising edge of done input.
  (A fault-tolerant accelerator should continuously asserts done and then has the guarantee that this will eventually be forwarded).
• The pulsed true_done output itself might also experience a single event upset in just the cycle where it is asserted and thus done signal is destroyed. To mitigate this extend the above mechanism to assert the output for two cycles at minimum.

This does not add any protection in the other direction e.g. an SEU causing an abort when the accelerator is in fact doing fine.