Pains, Gains and PLCs: Ten Lessons from Building an Industrial Control Systems Testbed for Security Research