psbt: refuse transaction-independent `SIGHASH_SINGLE` signatures #35977

The PSBT signing path can produce a signature that is not bound to the transaction. This happens when SignPSBTInput() is explicitly asked to sign a pre-SegWit input with SIGHASH_SINGLE, but the corresponding output is missing. The signature hash is then the constant digest uint256::ONE.

The underlying SIGHASH_SINGLE behavior is well known, the raw transaction signing path has refused this case since #1689.

This PSBT signing gap was also found and disclosed responsibly by the Red Team 🟥.