The required_auths field on custom_operation was being ignored during authority checking. This commit causes it to be checked correctly, and adds a unit test verifying as much.

Hardfork guards are complex for this issue, because we can't access
chain time in the operation's get_required_active_authorities() method.

There was no apparent 'good' way to solve this, so I settled for a
fairly nasty hack which seemed the least bad of bad options. Add a
boolean parameter to the verify_authority() functions determining
whether the custom_operation::required_auths field should be ignored or
not, and call these functions setting the boolean appropriately for
whether we have passed the hardfork or not. This works because chain
time is available at the verify_authority() call sites.

Mostly polish, but one mistake fix as well.