Support multiple change-outputs

[andrewkozlik]

Both T1 and TT firmware allow having only one change-output per transaction. If there are multiple change-outputs, then only the first one is treated accordingly and the remaining ones are treated as normal outputs, i.e. they are shown for confirmation and included in the total amount. The reason why this restriction was put in place was historically the lack of a use-case for multiple change-outputs and the risk of malware fragmenting the change over hundreds of outputs.

As new use-cases are emerging, we want to allow multiple change-outputs in a transaction. All outputs that are being returned to the same account as the one from which the inputs originate will not be shown for confirmation and will not be included in the total amount. To mitigate the attack mentioned above, a warning screen will be shown before signing the transaction whenever there are more than two change-outputs.

See also spesmilo/electrum#2440.