Script: handle pk_script and script_sig separately

never execute the script_sig, only push it onto the stack as data before running the pk_script.

one can still pass the script_sig + pk_script as one string, for backward compatibility.