Transaction guard

[rmeissner]

Add a transaction guard to can impose additional constraints for executing a transaction.

E.g. Safe configuration changes need to be announced beforehand or no delegate calls are allowed.

Open questions

• It is easy to "brick" a Safe with a wrong guard, how can this be prevented.

[CJentzsch]

I am very much in favor of this. With this one could for example, always require a certain key to be part of the signatures when the value to be sent is above a certain limit.

Regarding the security risks. They are at the same level as a wrong/malicious module.
A module could allow anyone to bypass the threshold rule and drain the wallet. A guard could also destroy the wallet completely by preventing access forever. The wallet is as secure as its weakest module/guard.