cli: Verify ELF with actual feature set on network before program deployment

[joncinque]

This is a copy of solana-labs#32462

Problem

As noticed in solana-labs#32448, there's currently an issue deploying programs to the network that use new syscalls. The quick solution there was to change the check to FeatureSet::all_enabled() to unblock users. This is OK because the loader will do a final check before deployment.

However, it's still possible to write an ELF buffer that contains an unactivated syscall, only for it to fail at the final stage deployment. That's not great UX, since the CLI can tell the user if their program contains unresolved symbols before ever attempting a deployment.

Proposed Solution

Rather than using FeatureSet::all_enabled(), fetch the actual feature set from the network and validate the ELF against that. We can also add a flag to skip these checks. This can be useful for a DAO or multisig queuing up a program upgrade once a syscall is activated.