NIP-07: let clients pin the user key

[nogringo]

The key behind window.nostr can change at any time without the page knowing:
the user switches account in the signer, or logs out and logs back in with a
different key. A client that called getPublicKey() at login has no way to
require that later calls still use that key, so it can keep acting under an
identity the user has left.

This adds an optional pubkey on the signEvent event object, and an optional
current_user on the nip04 and nip44 functions. When set, the signer MUST
use that key or reject the request. Signers that ignore them behave as today.

[alexgleason]

The client should just check the result of signEvent and throw an error if the pubkey doesn't match the logged-in user.

[nogringo]

A check tells the client that the key is wrong, but not how to make it right. Signers can hold several keys, and today the client has no way to say which one it means, so the only remedy is asking the user to go switch accounts in the signer, even though they already picked an account in the app.

It also doesn't cover the encryption functions: nip44.encrypt gives the client nothing to compare against, so encrypting under a stale account produces well-formed ciphertext that the recipient cannot read, and the failure only shows up on the other side.

NIP-55 already solved this with current_user, for the same reason.