Change epoch transaction should not use the execute_certificate()
codepath, but it can be done accidentally in tests or through the RPC
interface. Reject the transaction explicitly to give a better error
message.