Timelock Recovery Plugin using Ledger unnecessarily shows the address of the funds that remain on the same wallet.

Description

Hi, I've tested the Timelock Recovery plugin using Ledger and noticed a strange behavior. The first transaction that the plugin generates, which is called Alert\Initiate transaction, sends 600 sats to the external addresses (to support CPFP in case of need), and the rest of the funds back to an address on the same wallet, labeled as "Timelock Recovery Alert Address". This address is derived from the main derivation path: m/84'/0'/a'/0/i.
When you sign this transaction, Ledger displays this address as if it was an external address, even though the funds remain on the same wallet. Ledger only "hides" an output address when it is derived from a change path: m/84'/0'/a'/1/i.
The risk is that users won't verify that the address really belongs to them, and some virus will replace the address with a similar one.

A simple fix would be to choose the "Alert Address" (and also the "Cancellation Address") from the change-path instead of the main-path. It's a one line fix in timelock_recovery.py of the line that calls self.wallet.get_unused_addresses(). but I'm not sure what I should replace it with. Should it be self.wallet.get_change_addresses_for_new_transaction()? With or without "allow_reusing_used_change_addrs"? Or maybe I should call self.wallet.calc_unused_change_addresses()?

Start in timelock_recovery.py at the call to self.wallet.get_unused_addresses(). Compare get_change_addresses_for_new_transaction() and calc_unused_change_addresses(), including the allow_reusing_used_change_addrs option, to determine the appropriate change-path API. Done when Alert and Cancellation outputs remain wallet-owned and Ledger treats them as change addresses without breaking recovery behavior.