Improve custom proposal filtering

[mulmarta]

• Basic validity checks of custom proposals must be done before they are passed to custom MlsRules - else it is too late, as they already took effect
• Local proposals are treated as by-value instead of by-reference by the proposal filter. Filtering out local proposals without filtering out their parents is error-prone.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT license.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 97.43590% with 1 line in your changes missing coverage. Please review.

Project coverage is 90.16%. Comparing base (6d4a11a) to head (55ad632). Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
mls-rs/src/group/proposal_cache.rs	95.65%	1 Missing :warning:

Additional details and impacted files

```diff @@ Coverage Diff @@ ## main #205 +/- ## ========================================== + Coverage 90.15% 90.16% +0.01% ========================================== Files 175 175 Lines 31408 31421 +13 ========================================== + Hits 28315 28332 +17 + Misses 3093 3089 -4 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

[stefunctional]

As discussed with Marta, this change requires some care in clients so that they don't end up in a state where they cannot commit anymore. Specifically, if a client receives a custom proposal that expands to something invalid, the client cannot commit anymore until they explicitly clear their proposal cache.