Preimage handling

[aakselrod]

If we aren't trusting the node at all, we will want to be generating payment preimages/hashes in the signer rather than the node. We will also want to avoid signing payments for which we've already seen a matching preimage, because we know that the payment could get stolen en route. This is especially advantageous in multi-hosting environments where the signer can be aware of preimages discovered by multiple nodes, but we need to be aware of how that affects routing.