Require executor to be part of the signed message

[reednaa]

This is a breaking suggestion.

There has been findings associated with malicious execution:

• Gas limits
• DoS
• Reordering

The current implementation does not care for who executes a signed transaction. If this becomes a concern, we should consider requiring the Executor to be signed:

struct Calls {
    address executor;
    bytes32 mode;
    uint256 nonce;
    ERC7821.Call[] calls;
}

With Calls.executor === 0 indicating free for all. The signature hash could be derived twice:

1. Check msg.sender
2. Check address(0)

Allowing for a calldata neutral change and if signed with msg.sender this would remain inline with the current efficiency.