Add `--allow-insecure-coinbase` to enable using a random coinbase if none is set

After PR #306, we auto-generate a random coinbase address when none is provided. While this helps with quick testing, it's a potential footgun since real coinbase addresses are required in production.

Proposed fix: Add --allow-insecure-coinbase flag that must be set to enable random address generation. This makes users explicitly opt-in to running without a proper coinbase.