[kwsantiago]

On a channel with option_unified_sigs, BOLT 3 and BOLT 5 have the broadcaster sign its own half of an HTLC-success or HTLC-timeout transaction SIGHASH_ALL (0x21), with only the peer's half SIGHASH_SINGLE|SIGHASH_ANYONECANPAY (0xa3 under anchors). Our half was signed like the peer's. Since lightningd adds wallet inputs and change to fund these transactions, our signature now has to be made over the final transaction, and again on every fee bump.

• New hsmd message hsmd_sign_htlc_tx_mingle_unified signs the wallet inputs and then the HTLC input SIGHASH_ALL|SIGHASH_UNIFIED over the final transaction. It checks the HTLC input and output indexes, that the input's script is the P2WSH of the given witness script, that no wallet utxo is the HTLC outpoint, and that every input carries consistent prevout data. lightningd uses it for each RBF of an HTLC transaction on a unified channel and refuses to start against an HSM without it.
• do_sign_local_htlc_tx, and the direct spends of HTLC outputs on the peer's commitment, sign SIGHASH_ALL|SIGHASH_UNIFIED on unified channels.
• Channels without option_unified_sigs sign exactly as before.

Tests: the unified witness check now requires 0x21 for our half and 0xa3 for the peer's; test_unified_htlc_tx_rbf covers success and timeout through two fee bumps and two restarts, requiring a fresh 0x21 signature on each version; test_htlc_tx_rbf_without_unified_sigs pins the unchanged behavior without unified sigs; hsmd and sighash unit tests cover the new message and its refusals.

Changelog-None