Add more security invariants to the threat model

[defuse]

This ticket should be split into smaller ones, one for each invariant we want to add. In my draft threat model, I had:

We hope that one day, in the HONEST scenario, TYPICAL adversaries cannot:

• Cause the SDK to report a balance greater than what could actually be spent.
• Cause the SDK to report a transaction has been received when it hasn't.
  • This can happen accidentally until the reorg handling is sorted out.

[gmale]

in the UNTRUSTED threat model, we're not checking proof of work or other concerns that require the full block header (because the compact block only provides limited header information).

[gmale]

In the HONEST scenario, TYPICAL adversaries cannot learn transaction details (time, amount, recipient, etc.)