Ledger Bitcoin app

Merge pull request #542 from LedgerHQ/musig-fixes

Add some missing error propagation in `musig.c`

Fix missing return value checks for point_add calls

Also made the cast from size_t to int explicit, and fixed PRINTF
message that had an off-by-one.

Propagate crypto_tr_lift_x errors in cpoint

Merge pull request #539 from LedgerHQ/fix-stack-exhaustion

Fix stack exhaustion

Limit the amount of nesting for `thresh` fragments to 4

compute_thresh_ops and compute_thresh_stacksize each need two arrays of
MAX_N_IN_THRESH + 2 counters. Since they were inlined by the compiler,
they bloat the size of the stack frame of
compute_miniscript_policy_ext_info, which vastly reduces the stack usage
on usual policies.

Yet, stack usage would remain very large on policies that recursively
nest 'thresh' fragments.
Therefore, we add a limit of 4 nested thresh expressions, by keeping
track in the parsing context.

Reduce the stack frame of key_orderings_count

The memory occupation of key_orderings_count was quadratic in
CT_MAX_KEYEXPRS.

A more careful rewrite only require linear memory, saving several
kb of RAM.

More saving comes from narrowed some types to smaller integers.

Move the wallet confirmation stage out of the handler's frame

By not inlining the called functions, the memory occupation can be
substantially improved, as a lot of the data used during validation
are no longer needed during rendering and UI.

Delete MAX_POLICY_DEPTH; rather, align with MAX_PARSE_SCRIPT_RECURSION_DEPTH from the parsing stage

Add functional tests for the policy depth limits

Lowers MAX_N_IN_THRESH to 24

It is extremely unlikely to be hit in practice, and has a large memory
impact because of the dynamic programming tables of compute_thresh_ops()
and compute_thresh_stacksize()

The dynamic programming tables of compute_thresh_ops() and
compute_thresh_stacksize() are sized for MAX_N_IN_THRESH, causing them
to contribute a substantial stack usage, especially with nested
thresh fragments.

Count miniscript wrappers in the parser's recursion depth limit

parse_script bounds the depth of the parsed policy with
MAX_PARSE_SCRIPT_RECURSION_DEPTH, but the miniscript wrappers were
not charged to that budget; this can cause stack exhaustion in other
functions that process the parsed AST recursively.

Fix wrong comment in policy_node_thresh_t

Disable musig in key expressions of musig_a/sortedmulti_a

The parsing of such fragments is not correctly handled in the
current state. Therefore, we cleanly disable it until the parser
is generalized.

Additional integrity checks for Merkle proofs

Add unit tests for get_merkle_preimage

Type consistency in psbt_parse_rawtx, and some other hardenings

Change key_len and output_index to size_t for consistency with
other APIs, add some extra bounds checks.

Also adds:
- missing return value check on parser_consolidate_buffers
- reject trailing data during parsing
- zero txid_parser_outputs_t before starting parsing

Sign consistency for parser steps; removed stale comment

Harden prevout tx parsing checks

Fix taptree hash computation in test_utils

Do not truncate preset names

This is done automatically when rendering, and only if needed.

Nit from PR review, and add a tapminiscript preset

Fix presets with sighash flags in app playground

It didn't correctly manage 'negative fees' when the fee is
actually not computable.

Document signing behavior with sighash flags, and external inputs

Bump version to 2.5.0

Prepare changelog for release 2.5.0