Verify that only submitted inputs get signed

There is a coinjoin-themed attack whereby somebody submits a
transaction with an input belonging to another participant.
If the other participant isn't careful, he will sign the input
when signing the join, thus sending his own money to a
destination chosen by the attacker.

This commit adds a check that this doesn't happen -- if any
inputs get signed which weren't submitted to the server, the
client cries foul play and refuses to submit its signatures.