[remotesigning] Refactor destination validator to only use master seed

[alecchendev]

Currently, for all signing jobs, we derive Xpubs from the signing derivation path, and pass them into the validation interface. There's a couple issues with this:

1. These are using the wrong derivation paths. We pass Xpubs derived from the prefix of the derivation path into the validator so it can check if the destination of a transaction is derived from our seed. We should be using the destination derivation path, not the signing derivation path. This misleadingly works for L1 wallet signing requests, because the signing derivation path is the same as the destination (the prefix at least, for withdrawals).
2. We end up doing this weird thing where we derive part of the public key, then the other later, which just adds extra code/logic.
3. These Xpubs are not used at all for non-L1-wallet requests, and they aren't used for any validation by the HashValidator.

This PR refactors things so we simply provide the master seed to the validator, then derive pubkeys from there and pass it into the ValidateScript function.

[zhenlu]

oops

Error: ./server.go:40:15: cannot use remotesigning.PositiveValidator{} (value of type remotesigning.PositiveValidator) as remotesigning.Validator value in assignment: remotesigning.PositiveValidator does not implement remotesigning.Validator (wrong type for method ShouldSign)

[alecchendev]

fixed!