Make STRICTENC invalid pubkeys fail the script rather than the opcode.

This turns STRICTENC turn into a softforking-safe change (even though it
is not intended as a consensus rule), and as a result guarantee that using
it for mempool validation only results in consensus-valid transactions in
the mempool.
Test the exact order of CHECKMULTISIG sig/pubkey evaluation

Possible with STRICTENC