Add a trust policy for lazy-fetched note scripts

[JereSalo]

Manage granularly which scripts are allowed to run in a transaction in order to avoid security issues, especially when a script is lazily fetched from the RPC and executed without the user explicitly trusting it.

The underlying concern (a malicious note creator pointing at a malicious script) always existed, but before lazy script fetching landed (#1456 / #1812), the client errored with "script not found" if the bytes weren't local, forcing the user to import the script manually. That friction is now gone: the client silently fetches whatever script the note references and runs it.

@igamigo explains the threat with an example here: #1456 (comment)

[JereSalo]

I tackled this issue in #2136, here I proposed one way of solving this, it could be summarized as the following:
When executing a transaction we can now have granularity of what kind of scripts can be run during execution. The 3 categories that I've defined in terms of permissiveness (ascending order) are:

1. Standard Scripts Only
2. Standard Scripts + Roots of Specified Scripts
3. Any Script

These can be indicated right before execution of each transaction.

By default we use the most restrictive one (Standard Only) in order to protect the user from executing unwanted scripts. This change is breaking though because the previous default was the number 3 (implicitly, because we executed any script), so we can consider keeping that as default but perhaps it would be unsafer in the long term.