Cytochrome c oxidase structures suggest a four-state stochastic pump mechanism