Tracking: define a policy for reverts during user operation validation

[gonzaotc]

Per ERC-4337, account and paymaster validation should return SIG_VALIDATION_FAILED on signature mismatch rather than reverting. ERC-7562 [OP-020] additionally forbids reverting on out of gas. Several library paths reached during validation were reported to revert on it, so we need to define a policy and then take action. This issue tracks them together so the remaining fixes can potentially be onboarded together.

Open:

• M-01: Unchecked typeIndex arithmetic can trigger out-of-bounds mload and revert in WebAuthn type validation
• L-02: WebAuthn uses caller-provided challengeIndex/typeIndex to interpret signed clientDataJSON. Not a revert, listed because the fix touches the same code
• L-15: PaymasterERC20._erc20Cost can revert on ceil-rounding overflow, defeating its "return max on overflow" behavior

Closed, to revisit under the policy:

• L-03: Unbounded WebAuthn inputs can OOG during verification. Closed as false positive
• M-04: Unbounded-gas ERC-20 calls can leave insufficient gas for PaymasterERC20 to finish
  validation or postOp. Acknowledged, not resolved

Resolved:

• M-08: Unbounded signature forwarding can make paymaster validation revert instead of returning SIG_VALIDATION_FAILED. Resolved in MultiSignerERC7913: decode signature from calldata to avoid abi.decode reverts (M-08) #6642.
• L-10: RSA signature verification can revert on modExp failure despite returning bool. Resolved in Make fail closed on modexp failure #6638.
• L-18: MultiSignerERC7913 can revert on malformed signature encoding. Resolved in MultiSignerERC7913: decode signature from calldata to avoid abi.decode reverts (M-08) #6642.
• L-01: (v5.6 audit): Unexpected revert in WebAuthn._validateChallenge.. Resolved in Avoid revert caused by slice overflow in WebAuthn.verify #6329.