Avoiding footguns in receiver state machine

[spacebear21]

I've been working on the Boltz Payjoin integration and almost made a mistake that I think we can do better to help prevent.

While the receiver state machine ensures that all receiver checks are performed in the right order, it leaves the correctness of those checks in the hands of the application developer. In my case, I was working on implementing identify_receiver_outputs and basically copied the payjoin-cli reference approach of using bitcoin-cli's getaddressinfo to check if an output is mine. However:

1. Boltz "receive" addresses are complex locking scripts that bitcoin-cli cannot identify as "mine".
2. More importantly, it would be wrong to identify any Boltz address as a receiver output, since we are trying to do an atomic swap. In this scenario it's critical to ensure that we identify only a given swap's lockup address as a receiver output.

This is the OutputsUnknown interface that identifies which outputs belong to the receiver:

impl OutputsUnknown {
    /// Find which outputs belong to the receiver
    pub fn identify_receiver_outputs(
        self,
        is_receiver_output: impl Fn(&Script) -> Result<bool, ImplementationError>,
    ) -> Result<WantsOutputs, ReplyableError> {

Any identified output is then considered fair game by the receiver state machine to substitute, and all additional input value added by the receiver is added to the change output as identified by this method. Thus it is critical for implementers to get this right.

We can certainly do better with the docstring. @nothingmuch also suggested renaming some functions, and the persistence event log as a way to at least monitor/alert implementation errors.