feat: add DefaultSecurityHook for ERC-7579 accounts

[leekt]

Summary

• Adds DefaultSecurityHook, a default security hook for ERC-7579 smart accounts that blocks dangerous operations by default
• Blocks: DELEGATECALL, self-calls, module calls, ETH transfers, ERC-20/721/1155 transfer and approval selectors (including increaseAllowance/decreaseAllowance)
• Per-account (target, selector[]) allowlist mechanism — empty selectors = allow all calls to target, specific selectors = only those bypass checks
• Supports both single and batch execution mode inspection
• Reverts on unknown call types (defense-in-depth)

Test plan

• 49 BTT tests covering all deny-list checks, allowlist logic, batch execution, lifecycle, and view functions
• 100% branch coverage