Improve custom proposal filtering

[mulmarta]

• Basic validity checks of custom proposals must be done before they are passed to custom MlsRules - else it is too late, as they already took effect
• Local proposals are treated as by-value instead of by-reference by the proposal filter. Filtering out local proposals without filtering out their parents is error-prone.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT license.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 97.43590% with 1 line in your changes missing coverage. Please review.

Project coverage is 90.16%. Comparing base (6d4a11a) to head (55ad632).
Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
mls-rs/src/group/proposal_cache.rs	95.65%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #205      +/-   ##
==========================================
+ Coverage   90.15%   90.16%   +0.01%     
==========================================
  Files         175      175              
  Lines       31408    31421      +13     
==========================================
+ Hits        28315    28332      +17     
+ Misses       3093     3089       -4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[stefunctional]

As discussed with Marta, this change requires some care in clients so that they don't end up in a state where they cannot commit anymore. Specifically, if a client receives a custom proposal that expands to something invalid, the client cannot commit anymore until they explicitly clear their proposal cache.