Add a trust policy for lazy-fetched note scripts

Manage granularly which scripts are allowed to run in a transaction in order to avoid security issues, especially when a script is lazily fetched from the RPC and executed without the user explicitly trusting it.

The underlying concern (a malicious note creator pointing at a malicious script) always existed, but before lazy script fetching landed (#1456 / #1812), the client errored with "script not found" if the bytes weren't local, forcing the user to import the script manually. That friction is now gone: the client silently fetches whatever script the note references and runs it.

@igamigo explains the threat with an example here: https://github.com/0xMiden/miden-client/issues/1456#issuecomment-3807806726

Look at the lazy script fetching implementation from PRs #1456 and #1812. Understand how scripts are fetched from RPC and executed. The trust policy needs to be integrated into this flow, likely in the client library's transaction handling code. 'Done' means a user can configure which scripts are trusted before execution.

Rédigé par le modèle d'indexation à partir du texte de l'issue.