Rust reducers must disallow reducers starting with reserved prefix

The API proposal states:

Reserved reducer names

We reserve all reducer names beginning with two underscores __, and with on or On. Double-underscore reducer names are used internally to implement built-in reducers, and on/On are used in SDK codegen for reducer callbacks.

Attempting to define a reducer with a name that matches these patterns will cause an error at macro-expand time. Implementors are also encouraged to signal an error at publish time if a module circumvents the bindings library and manually constructs a ModuleDef containing one of these names in a reserved position.

Those are rejected in C# as per proposal, but not in Rust. In fact, rust-wasm-test actually defines such a reducer that should be illegal now:

https://github.com/clockworklabs/SpacetimeDB/blob/729dbb149599b4535c3b4d4e2fb4594be7ea448f/modules/rust-wasm-test/src/lib.rs#L241-L242

and in generated TS code it ends up looking as OnOnConnect event.

Start with the reserved reducer proposal and the reducer definition at modules/rust-wasm-test/src/lib.rs#L241-L242, then trace Rust macro expansion and validation. Ensure names beginning with __, on, or On are rejected at macro-expand time, and verify the generated TypeScript no longer produces names such as OnOnConnect.