contractcourt: validate timeout second-level outputs

[yyforyongyu]

Summary

Validate re-signed outgoing HTLC timeout spends before treating their indexed
output as the second-level sweep target.

Change Description

• Share second-level output matching across success and timeout resolvers.
• Validate confirmed and mempool timeout spends at the watcher boundary.
• Treat foreign live and restored spends as terminal timeouts without offering
  phantom sweeper inputs.
• Document the companion fix in the 0.20.4 and 0.21.3 release notes.

Notes

Draft follow-up to #10869, now rebased onto its merge in master. This resolves
the outgoing-timeout follow-up raised in the originating review comment
and the request to track it.

[github-actions]

🔴 PR Severity: CRITICAL

file-based classification | 11 files | 2322 lines changed

🔴 Critical (3 files)

• contractcourt/htlc_success_resolver.go - on-chain dispute resolution, second-level sweep target matching
• contractcourt/htlc_timeout_resolver.go - on-chain dispute resolution, HTLC timeout spend validation
• input/script_utils.go - script signing / witness generation utilities

🟢 Low (7 files)

• contractcourt/channel_arbitrator_test.go - test-only change
• contractcourt/htlc_outgoing_contest_resolver_test.go - test-only change
• contractcourt/htlc_success_resolver_test.go - test-only change
• contractcourt/htlc_timeout_resolver_test.go - test-only change
• contractcourt/mock_htlcnotifier_test.go - mock/test-only change
• docs/release-notes/release-notes-0.20.4.md - release notes
• docs/release-notes/release-notes-0.21.3.md - release notes
• input/script_utils_test.go - test-only change

Analysis

This PR modifies contractcourt/htlc_success_resolver.go and
contractcourt/htlc_timeout_resolver.go (on-chain breach/timeout dispute
resolution logic) as well as input/script_utils.go (witness/script
validation for re-signed HTLC timeout spends). Both packages are on the
CRITICAL list, and the PR touches two distinct critical packages
(contractcourt/* and input/*), with non-test/non-doc line changes
(~535 lines across the three core files) exceeding the 500-line bump
threshold as well. Since the base classification is already CRITICAL,
these bump conditions don't change the outcome but reinforce it. This
touches consensus-critical validation of timeout-spend outputs feeding
the sweeper — expert review recommended.

---

_{To override, add a severity-override-{critical,high,medium,low} label.}