Status API and propagation

The Tonic API allows for easy propagation of errors between clients and servers. E.g.

```rust
fn server_handler(_) -> Result<_, tonic::Status> {
_ = client.outgoing_call(_).await? // Return any client status as a server status
}
```

This usage is problematic for two reasons:

1. If the status code is directly propagated, then it can cause correctness issues. E.g. if the client above returned INVALID_ARGUMENT, then that probably should go back from the outer service as INTERNAL, since it was likely a programmer error in the service making the call to the client.

2. If the trailers are propagated along with the status, then that's a security issue, since they could contain sensitive information.

I believe we need a change that prevents `?` from being able to propagate statuses in this way, e.g. by having a different `Status` type returned by servers than the one given to clients.