Force failsafe

This branch forces failsafe outputs on IO as soon as the IOCTL is called. It might need securing with an enable flag or magic, but its operational (and API-stable on FMU side) for testing.

This PR adds also definitions for external sensors, in preparation for the SBUS2 sensors branch (or HoTT).

We should next think about how to do a voting class in C++ which allows to take several inputs and come up with a voting scheme to decide wether an input is valid and once an input has been deemed valid, which one to give first priority.