Address SIGN_MODE_LEGACY_AMINO_JSON security issues

[aaronc]

SIGN_MODE_DIRECT addresses malleability by signing raw bytes. Amino JSON signing requires extra care to deal with malleability.

In order to prevent exploits, we need to:

• reject all unknown protobuf fields (Protobuf unknown field rejection #6192), non-critical fields cannot be enabled with amino JSON signing
• make sure that all new fields on TxBody either have a direct counterpart in StdTx or cause transactions to fail and make sure that SIGN_MODE_LEGACY_AMINO_JSON handles this properly

If the above are not done, a malicious attacker can either add:

• random unknown, non-critical fields to protobuf tx's bloating transactions, or
• set fields on TxBody that weren't present in the amino JSON SignDoc