fix(electrum): bdk_electrum exploit fixes

[LagginTimes]

Fixes #1698, #1697.

Description

The aim of this PR is to fix a few exploits that were found within bdk_electrum. Most notably:

• Transaction Merkle proof verification does not check the Merkle proof for the coinbase. This enables an attack by which an attacker can fake a deeply-confirmed payment to a BDK wallet. (https://delvingbitcoin.org/t/great-consensus-cleanup-revival/710#merkle-tree-attacks-using-64-bytes-transactions-8)
• An Electrum server can trigger a panic in populate_with_txids by returning a transaction with no output.
• fetch_prev_txout should not try to query the prevouts of coinbase transactions. This will query a transaction to the Electrum server which will return an error and will make the overall sync fail.

Notes to the reviewers

• This is draft PR that is dependent on the following rust-electrum-client PR: feat: add id_from_pos support rust-electrum-client#155
• The validate_merkle test commit needs significant review. My initial thoughts were to put MockElectrumClient into bdk_testenv, but because bdk_testenv's electrum-client is re-exported from electrsd, a separate dependency would have to be added for just electrum-client as such that support for txid_with_pos will be available when PR#155 is merged. Or perhaps there is a better way to specifically test validate_merkle_for_anchor that does not involve creating a MockElectrumClient.

Changelog notice

TODO

Checklists

All Submissions:

• I've signed all my commits
• I followed the contribution guidelines
• I ran cargo fmt and cargo clippy before committing

New Features:

• I've added tests for the new feature
• I've added docs for the new feature

Bugfixes:

• This pull request breaks the existing API
• I've added tests to reproduce the issue which are now passing
• I'm linking the issue being fixed by this PR