AggLayer: validate only `CONFIG_AGG_BRIDGE` notes from the bridge admin are processed

[mmagician]

Porting from #2140, one thing still missing after adding the faucet registry is:

• Implementing basic validation to ensure that only notes from the authorized admin account can update the bridge configuration.

The reason is that the config functionality itself is needed for the registry, but ensuring authorization is a separate line of work that can be done in a follow up tracked in this very issue

[mmagician]

Furthermore, we should limit who can consume these notes by adding a check similar to what we do with CLAIM note.
This means that overall, we need two "account checks", one for the sender, and one for the receiver.

1. NoteMetadata must specify NetworkAccountTarget attachment (targeting the bridge account). This doesn't enforce anything on the consumer of the note per-se, it serves purely to inform NTX about the network account that should consume it, but in theory another user could snatch this note and consume it, provided that their account interface is compatible, effectively erasing the note and causing grievance to the bridge (operator). The note should further implement the following check:

exec.network_account_target::active_account_matches_target_account
assert.err=ERR_B2AGG_TARGET_ACCOUNT_MISMATCH

2. Sender check: must be the bridge operator